22 February 2019

Group-IB: 2 new databases with nearly 70000 Pakistani banks’ cards with PINs go on sale on the dark web. Again

Group-IB, an international company that specializes in preventing cyberattacks, has discovered new databases with a total of 69,189 Pakistani banks’ cards that have shown up for sale on the dark web. The total market value of the databases is estimated at nearly 3.5 million USD. According to Group-IB data, it is the second big sale of Pakistani banks’ cards in the past 6 months, which may indicate the activity of advanced financially motivated threat actors in the region.


Double trouble for Pakistani banks

Group-IB Threat Intelligence team has discovered two new databases with tens of thousands of Pakistani banks’ cards that were releases on Joker’s Stash, one of the most popular underground hubs of stolen card data, at the end of January 2019. 96% of all card dumps, unauthorized digital copies of the information contained in magnetic stripe of a payment card, were related to a single bank — Meezan Bank Ltd. Pakistani banks’ cards are rarely sold on underground cardshops. This, and the fact that all the cards came on sale with PIN codes explains the high price, which was kept at 50 USD per card, while usually the price per card on dark web forums ranges from 10 to 40 USD.

First set of dumps, titled «PAKISTAN-D+P-01», was set up for sale on Jan. 24, 2019 and included 1,535 cards, 1,457 of which were issued by Meezan Bank Ltd. It is worth noting that this batch of cards was not announced on the forum.

The second database was put up on Joker’s Stash on January 30th. The «PAKISTAN-D+P-02» set, comprised of the details of 67,654 cards of Pakistani banks was significantly larger. The sellers marked the set as «high valid» and, unlike the first set, advertised the database on all major underground forums such as («Omerta», «Crdclub», «Enclave» etc.). 96% of all cards in the set were also related to Meezan Bank Ltd.

The scale, volume, frequency and connection to one institution contributes to the theory that the leak might be involved in a larger incident, potentially an advanced actor gaining access to card systems within Pakistan.

Dmitry Shestakov

Dmitry Shestakov

Head of Group-IB сybercrime research unit

Why on earth would anyone bother?

Those who buy the cards on dark web forums can use card dumps data to produce cloned credit cards. Then money mules use these fake cards to either withdraw money from ATMs or buy goods in, which are later resold by fraudsters. Another scheme of cashing out involves the use «white plastic» dumps (cloned cards) and dummy companies (linked to money mules) with bank accounts and POS terminals: fraudsters use «white plastic» to buy nonexistent goods, and funds from compromised cards get transferred to bank accounts linked to dummy companies, then cybercriminals withdraw money via ATM using a bank card which is linked to a dummy company. This method is quickly detected by antifraud systems and involves high risks. However, emerging markets banks frequently do not have adequate anti-fraud controls, making this attack type viable.


Give ‘em a break

Earlier In November 2018, Group-IB Threat Intelligence team already reported about massive leaks of 177,878 payment cards of Pakistani and other international banks. The banks affected by this breach included major Pakistani banks financial organizations such as, Habib Bank, MCB Bank Limited, Allied Bank Limited and many others. Prior to the November leak, Group-IB experts detected two smaller Pakistani banks’ compromised cards uploads to the cardshop. The first one occurred on Oct. 26 and had 10,467 payment cards, another set surfaced on the dark web on Oct. 31 and included 11,795 cards issued by the leading Pakistani and other regions’ banks.

Group-IB Threat Intelligence continuously detects and analyses data uploaded to card shops all over the world. According to Group-IB’s annual Hi-Tech Crime Trends 2018 report, on average, from June 2017 to August 2018, the details of 1.8 million payment cards were uploaded to card shops monthly.

Group-IB is one of the leading providers of solutions dedicated to detecting and preventing cyberattacks, identifying online fraud, investigation of high-tech crimes and intellectual property protection, headquartered in Singapore. The company’s threat intelligence and research centers are located in the Middle East (Dubai), the Asia-Pacific (Singapore), Europe (Amsterdam), and Russia (Moscow).

Group-IB’s Threat Intelligence & Attribution system has been named one of the best in class by Gartner, Forrester, and IDC. Group-IB’s Threat Hunting Framework (earlier known as TDS) intended for the proactive search and the protection against complex and previously unknown cyberthreats has been recognized as one of the leaders in Network Detection and Response by the leading European analyst agency KuppingerCole Analysts AG, while Group-IB itself has been recognized as a Product Leader and Innovation Leader. Gartner identified Group-IB as a Representative Vendor in Online Fraud Detection for its Fraud Hunting Platform. In addition, Group-IB was granted Frost & Sullivan’s Innovation Excellence award for its Digital Risk Protection (DRP), an Al-driven platform for identifying and mitigating digital risks and counteracting brand impersonation attacks with the company’s patented technologies at its core.

Group-IB’s technological leadership and R&D capabilities are built on the company’s 18 years of hands-on experience in cybercrime investigations worldwide and 70,000 hours of cybersecurity incident response accumulated in our leading forensic laboratory, high-tech crime investigations department, and round-the-clock CERT-GIB. Group-IB is a partner of Europol.

Group-IB’s experience in threat hunting and cyber intelligence has been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyberattacks. Group-IB’s mission is to fight high-tech crime while protecting our clients in cyberspace and helping them achieve their goals. To do so, we analyze cyber threats, develop our infrastructure to monitor them, respond to incidents, investigate complex high-tech crimes, and design unique technologies, solutions, and services to counteract adversaries.

Report an incident

Get 24/7 incident response assistance from our global team

APAC: +65 3159-3798
Europe: +31 20 226-90-90
EMA: +971 4 508 1605

Thank you for filling out the form! We will get back to you shortly.

We use cookies on the website to make your browser experience more personal, convenient and secure. You may block or manage the use of cookies, however, in some cases they’re essential to make this site work properly. Learn more about cookies in Group-IB Privacy And Cookies Policy.

Report an incident