Trend Micro researchers have recently released new details regarding the cybermercenary group Void Balaur (aka Rockethack). Cybermercenaries are “groups or individuals that… offer different kinds of internet-based products and services to their clients, such as governments, crime organizations, and even businesses, for a price”. Void Balaur is believed to have been active since 2015 and has targeted over 3,500 victims with some suffering repeated attacks. A major service of the cybermercenary group is “hacking into the mailboxes of email providers and social media accounts”, where it can provide “complete copies of mailboxes that are stolen without any user interaction for a higher price”. Researchers, in their report linked below, described this offer as interesting, as “it would take unusual circumstances such as an insider threat or the compromise of an email provider’s system to be able to offer private data without user interaction”. Void Balaur has a history of advertising other services as well, such as launching distributed denial-of-service (DDoS) attacks and “flooding phone numbers in Commonwealth of Independent States (CIS) countries”. Void Balaur began selling sensitive, private data of Russian individuals in 2019 as well, which includes passport/flight data, criminal records, account balance/statements, credit history details, and SMS messages. The “hacker-for-hire” group targets a range of entities/individuals, including “journalists, human rights activists, politicians, scientists, doctors working in IVF clinics, genomics and biotechnology companies, and telecom engineers”. The majority of the targets are located in Russia, Ukraine, Kazakhstan, and Slovakia along with less victims being located in the United States, European nations, Israel, India, and Japan. Trend Micro’s overview report of Void Balaur, their more comprehensive report, and their list of indicators of compromise (IOCs) are all linked below for review.