# data[].attributes.body
April 4 2023 marks the day when one of the largest marketplaces selling stolen digital identities, the Genesis Market, had its control seized by the FBI. Enforcement from 17 countries, including Australia, worked collaboratively to shut down the site, in an operation dubbed 'Operation Cookie Monster.'

Over 2 million individuals had their identities listed for sale on the site.

Operation Cookie Monster resulted in the arrest of 119 cybercriminals worldwide, with 208 raids taking place.

Genesis Market used malware to compromise victims' devices, allowing cybercriminals to gain data: Fingerprints, cookies, saved logins, and autofill form data. They were also given the means to use whatever data it is they bought. The buyers would be alerted to any password changes, making it impossible for victims to regain security and control. Utilising a browser identical to their victims', buyers could use their information without triggering any of the security measures that may have alerted their victim. Even with all of those services, one of the features that made Genesis Market so dangerous, is how accessible it was to those seeking to use it.

Easy access to illegal services increases the commonality of them. Digital drift is a term that describes the phenomenon of individuals - younger individuals in particular - engaging and disengaging in benign crimes. The internet has increased the occurrence of digital drift, as it becomes much easier to access forums, groups, and websites than enable and encourage crime as a form of entertainment. Genesis Market's easy invite-only access provided those with money a way to get more of it, and without ever seeing their victims, it would be easier to view them as nothing more than a means to getting money.

The day following Genesis Market's shutdown, a 32-year-old Melbourne man was arrested for using and buying data from the site. Police seized a mobile phone and laptop, with forensic examination finding approximately 650 stolen credentials he had purchased. He was charged, and later sentenced after pleading guilty.

Genesis Market was one of the biggest online spaces for cybercriminals to buy stolen identities and information, and with its closure, it is likely that another site will eventually emerge. Hopefully, Operation Cookie Monster can be used as a reference to deal with possible emerging illegal online marketplaces in the future.

# data[].attributes.attachment_link.title
Stolen data market takedowns continue as Genesis Market becomes the latest casualty

# data[].attributes.attachment_link.description
OFAC has promptly sanctioned Genesis and dozens of alleged affiliates have been arrested, in a major milestone in the fight against cybercrime.

# data[].attributes.body
On December 21 2024, it was identified that the Victorian Supreme, County, Magistrates', Coroners' and possibly the Children's Courts had been targeted in a large-scale cyber attack.

The attack on Victorian courts is believed to be a ransomware attack, although no demands for payments have been made as of February 2025. Australian courts are not the first to be targeted, with incidents taking place across the globe in Chile, the US, Brazil, as well as the International Criminal Court. Courts in general are also not the only targets for ransomware attacks.

Speculation around the possibility of this being a double extortion tactic has been presented. With a double extortion approach, the data gathered from the courts' audio-visual system would be taken and then encrypted. This approach doubles how much victims of this tactic are demanded to pay, as not only do they have to pay to receive the data, they also need to pay for it to be accessible.

Incidents involving ransomware are becoming increasingly more common, with 118 of the 127 extortion-related crimes in the previous year were incidents of ransomware. The Australian Signals Directorate (ASD) spoke alongside the media during coverage of the Victorian Courts' attack. Victims of ransomware are advised by the ASD to not pay whatever it is cybercriminals ask for. This makes sense, as there is no way to ensure that your data will be returned to you safely, or at all. Individuals and especially businesses, should report incidents of data breaches to the relevant authorities for the best possible outcome.

Aside from obtaining the best outcome, it is important to report incidents of ransomware - and cybercrime in general - to the authorities, as it alerts them to any possible patterns going on in the digital crime network.

Cyber attacks cause a lot of panic in communities, as breaches of private and often sensitive data put people's livelihood and safety at risk This attack on the courts is especially concerning. So, to help ease those concerned, there is an FAQ site posted by Court Services Victoria related to the cyber attacks.

As of now, there has been no conclusion to this instance of data breaching. Evidence shows that there is the possibility for involvement of the Russian-based hacking gang Qilin - also known as Agenda - present, however, nothing is confirmed.

# data[].attributes.attachment_link.title
Australia just had its first major reported cyber attack on a court system. Here’s why it may have been targeted

# data[].attributes.attachment_link.description
A suspected Russian ransomware hack on Victoria’s court systems was the first major reported cyber attack on Australia’s justice system — but a look overseas shows courts are popular targets for criminals.

# data[].attributes.body
Amy Jayne Everett, or as she was known, "Dolly", took her own life following bullying she faced at school. Bullying that took place in both face-to-face interactions, and digitally. Following her death, changes would be made to New South Wales law regarding domestic and personal violence.

Serious bullying is a crime that can take place in both the terrestrial and cyberspace, however, laws regarding cyberbullying took time to come into place. Bullying itself has existed in society across the span of time, and with the introduction of online spaces, it has become cyber-enabled. Bullying no longer requires face-to-face interaction to take place, placing victims at greater risk.

Dolly, unfortunately, faced both forms of bullying while attending Scots PGC College, a private Queensland boarding school. Verbal and physical abuse were improperly dealt with by faculty, despite concerns being raised by both Kate and Tick Everett - Dolly's parents.

The bullying lasted ages 12 to 14, the span of her time at the private boarding school, and only worsened as time progressed. On top of the abuse she was already facing, image-based abuse came into play after one of her fellow students convinced Dolly to "take photographs of herself and send them to him."

Her death made clear exactly how seriously cyberbullying can affect a vulnerable person, which falls in line with the 'Routine Activity Theory' (RAT). RAT builds upon a previously established theory, and states that in order for a crime to occur, there must be 3 elements present: A motivated offender, a suitable target, and the absence of a capable guardian. Online spaces contain a distinct lack of capable monitors, even with features such as blocking and reporting. Deleting social media isn't always an option, either, especially in cases like Dolly's. Social media is a way of remote communication, and while away from home, it would have been vital for Dolly to keep those connections.

The changes that would be made to New South Wales law regarding domestic and personal violence (section 13) involved addressing behaviours that amount to stalking or intimidation, with intent to cause fear, and mental or physical harm. The maximum penalty of such behaviours is 5 years imprisonment.

In addition to law reforms, Kate and Tick Everett were able to start a foundation in honour of their daughter. Dolly's Dream would come to bring both families affected by suicide as a result of bullying together, and provide support for children facing both terrestrial and cyber torment.

# data[].attributes.attachment_link.title
Australian of the Year: Kate and Tick Everett, advocates against bullying #AOTY2019

# data[].attributes.body
LabHost was a website that launched in late 2021, that provided phishing as a service (PhaaS) for paying customers. Thousands of cyber criminals would come to use this site, resulting in hundreds of thousands of victims globally.

Phishing is a cyber-dependent crime, meaning that it is entirely reliant on technology and the digital realm to occur. This leaves those not well versed in cyber security at a greater risk of phishing, as the fast-developing methods of such a crime make it incredibly difficult to discern potential threats. In the case of LabHost, this technological development is what made the service so dangerous.

Victims of these cybercrimes made possible by LabHost would receive fake SMS messages from a service in their countries, selling the realism of the text. Often, these SMS messages would pose as mail-related services, prompting the victim to disclose details such as their full name, address, and card information. Other brands accessible to the user of LabHost included banks, and government websites. By posing as legitimate and local services, the line between threat and innocuity becomes blurred.

April 18 2024 would mark the fall of this site, with a collaborative effort from international law enforcement and trusted private industries resulting in the PhaaS site being taken down, and multiple arrests taking place.

Amongst those arrested in the wake of the sting operation was a 21-year-old Melbourne man. Alone, he victimised 11 Australians, of which two were defrauded out of $34,000. After pleading guilty to the charges against him, the Melbourne man was given the sanctions of: 3 months' imprisonment, an 18-month community corrections order including 200 hours of community service, and a compensation order of $34,990.

The success of this sting operation provides hope for possible further operations in the future surrounding cyber crime. With the internet being a worldwide thing, getting justice against offenders who use the internet as their 'hunting ground' becomes extremely complicated. Jurisdictional issues arise when the offender and victim are not in the same country. So where the Melbourne man was able to face punishment for his crimes against fellow Australians, victims outside of Australia may not receive the same outcome. This is called 'Jurisdictional disparity.'

There are also issues faced by police. LabHost proves that the technology for cybercrime is becoming increasingly more accessible, and complicated. Over 40,000 different fraudulent sites hosted by LabHost were shut down, which begs the question of how law enforcement is meant to train in and keep up with an ever-growing world of cybercrime.

# data[].attributes.attachment_link.readable_text
Cyber Crime

On April 18, 2024, the UK's Metropolitan Police Service and others conducted an operation that succeeded in taking down the Phishing-as-a-Service provider LabHost.

By: Trend Micro Research Read time: ( words)

LabHost takedown

On Thursday, April 18, 2024, the UK's Metropolitan Police Service, along with fellow UK and international law enforcement, as well as several trusted private industry partners, conducted an operation that succeeded in taking down the Phishing-as-a-Service (PhaaS) provider LabHost. This move was also timed to coincide with a number of key arrests related to this operation. In this entry, we will briefly explain what LabHost was, how it affected its victims, and the impact of this law enforcement operation - including the assistance provided by Trend Micro.

What is LabHost?

In late 2021, LabHost (AKA LabRat) emerged as a new PhaaS platform, growing over time to eventually offer dozens of phishing pages targeting banks, high-profile organisations, and other service providers located around the world, but most notably in Canada, the US, and the UK. The popularity of the platform meant that at the time of the takedown, it boasted more than 2,000 criminal users, who had used it to deploy over 40,000 fraudulent sites leading to hundreds of thousands of victims worldwide.

The platform offered a number of key benefits to its criminal clientele, including:

The ability to obtain two-factor authentication (2FA) codes by proxying the connection to the phished organisation using Adversary-in-the-Middle (AitM) techniques. This is implemented in a tool called LabRat.

Phishing pages for several key Canadian, US, and international banks

Phishing pages for additional services such as Spotify, postal services such as DHL and An Post (the Irish post office), car toll services, insurance providers, and more.

Highly customisable phishing templates that can request standard name and address information, email, dates of birth, standard security question answers, card numbers, passwords, and PINs.

The ability to request the creation of bespoke phishing pages for target brands.

Ease of management, since the platform takes care of most of the tedious tasks in developing and managing phishing page infrastructure; all the malicious actor needs is a virtual private server (VPS) to host the files and from which the platform can automatically deploy.

Detailed campaign success statistics for criminal users.

Management of any successfully stolen credentials.

A popular SMS smishing component, LabSend, that supports customised SMS templates; this greatly eases the distribution of the phishing pages to target victims.

In essence, a PhaaS outsources the traditional task of having to develop and host phishing pages for a target organisation, plus having to develop methods to extract stolen details, substantially dropping the barrier for entry to phishing

Note that LabHost was not the only such PhaaS provider - there were many others, such as Frappo and Greatness. Furthermore, there were several red-team tools developed for similar purposes, such as Evilgophish, EvilPhish, and EvilGinx2. However, LabHost was certainly one of the most popular and damaging in the market.

LabHost offered three membership tiers paid via bitcoin:

Standard (US$179 per month). This offered dozens of pages targeting Canadian institutions and hosted of a maximum of three active phishing pages at the same time.

Premium (US$249 per month). In addition to all the features of the Standard tier, Premium offered dozens of pages targeting US institutions and increased the size of its active phishing pages to 20.

World Membership (US$300 per month). The highest tier offered over 70 phishing pages targeting international organisations and added 10 hosted phishing pages (separate to Premium or Standard licences). These include organisations in Andorra, Argentina, Australia, Austria, Bolivia, Brazil, Colombia, France, Germany, Guatemala, Hong Kong, Ireland, Italy, Netherlands, Luxembourg, Malaysia, Mexico, Netherlands, Poland, Portugal, Russia, Saudi Arabia, South Korea, Spain, Sweden, Turkey, UAE, and Venezuela.

Quarterly and annual subscriptions were also available. In addition, the platform administrators offered technical support services via a dedicated Telegram channel for all service levels.

Example attack flow

Figure 3 shows an example of a fairly typical attack flow for an SMS-based phishing attack from LabHost, based on the target's perspective.

The user's target phone receives an SMS related to a service offered in their country - in this case, it mimicked a customs charge on a posted item to Ireland. Since Ireland is an island nation, it's not unusual for Irish people who are expecting a parcel from outside of the EU (such as the UK or the US) to receive these kinds of legitimate requests. Other common targeting techniques used against Irish users include local bank or local road toll services, or their equivalents from other countries.

1. In this case, the smish would have been sent via the LabSend module of the LabHost platform, likely leveraging a farm of dedicated mobile devices created for this purpose. Note that the fee is set to a small amount to avoid raising suspicion.

2. Once the target selects this link, they are directed to a highly convincing page that copies the look and feel of An Post, the Irish postal service and the legitimate entity that normally processes these kinds of customs payments. The user is then prompted to input their phone number; however, in testing, this does not need to match the targeted phone, so it does not function as a safety check.

3. Rather than present the user with all the details the attackers wants to gather on one screen (which might trigger suspicion) the attackers break these details up over several screens.

4. The fake page initially asks for the user's name and address (Eircode is a postcode system used in Ireland), then requests classic credit card details, including the security code. Once completed, all these details will be sent via the phishing page (hosted on a user of LabHost's infrastructure) to the main LabHost panel, with an alert being sent to the cybercriminal user. The user can then simply log in to LabHost and retrieve these details, or export all of the gathered credentials for a given time period.

While this is an example of an attack against an Irish target, a similar attack flow exists using different brands for other regions on both mobile and desktop devices. Mobile devices have an advantage for attackers since they frequently lack installed security software, making users more susceptible to carrying out small transactions on them without practising due diligence. Such attacks not only negatively affect the target victim but also indirectly affect the impersonated brands themselves, potentially undermining trust and leading them to receive support calls for which they can do little to assist the victim.

What action did law enforcement take?

On Thursday, April 18, 2024, LabHost and all linked fraudulent sites were disrupted by the Metropolitan Police Service and replaced with messages announcing their seizure. This operation was carried out in partnership with the UK's National Crime Agency, the City of London Police, Europol, Regional Organised Crime Units (ROCUs) across the UK, and other international police forces in close collaboration with trusted private industry organisations.

In addition, from April 14 to April 17, international law enforcement made several arrests related to criminal users of this service. International law enforcement also contacted hundreds more, mentioning that it knew the details of their activities and leaving a warning that they remain under active investigation.

The press release articulates the scale of the service, including the large amount of money earned from it for an approximate period of two and a half years, the number of fraudulent domains created, and the volume of stolen credentials. The removal of this service and several of its key users will yield a significant impact on these types of phishing fraud attacks as a result.

Trend has been assisting in the investigation of LabHost along with the UK's Metropolitan Police Service since June 2023. During that time we have helped in the following:

Investigating the infrastructure hosting the criminal service

Investigating phishing pages associated with users of the service

Assisting with the triage and clustering of LabHost users

Launching individual investigations on several key users

This is in keeping with Trend's guiding mission to make the world safe for the exchange of digital information, for both our customers and non-customers alike. We have been collaborating with law enforcement globally for decades and have formal partnerships with UK law enforcement going back almost 10 years, with several successful operations and arrests. Such partnerships help us not only to proactively protect our customer base with highly timely threat intelligence but also expand that impact to the wider internet userbase.

In taking this action, the Metropolitan Police Service and its partners have helped remove a major player in the phishing ecosystem, weakening the toolkits of malicious actors while also spreading uncertainty amongst their userbase. This will have an immediate effect on the targets of phishing attacks carried out using the platform, thereby helping to safeguard victims (who would unfortunately receive messages that impersonate legitimate brands) and the affected brands themselves.

We would like to take this opportunity to congratulate the Metropolitan Police Service on its lead role in this operation, its international and local law enforcement partners, and our fellow trusted private industry colleagues on all the hard work that went into this case. We look forward to many continued successful endeavours in the future.

Key indicators

The following are the main landing pages for the now disabled service. Each of these e is proactively blocked by Trend so that our customers are aware if anyone on their network is visiting these sites.

labhost[.]cc (historical)

labhost[.]co (historical)

labhost[.]xyz (historical)

labhost[.]ru (historical)

lab-host[.]ru

In addition, the platform was used to generate over 40,000 fraudulent sites with many new phishing URLs added daily for its customer base. Trend protects customers from these URLs using a combination of sourcing and behavioural detection methods, primarily tagging them with the category "PHISHKIT" in our logs.

As mentioned previously, other PhaaS-type services still exist, and we continue to actively monitor and provide protection for ongoing campaigns. For advice on protecting yourself from phishing attacks, please visit our phishing definition page.

# data[].attributes.attachment_link.title
The Fall of LabHost: Law Enforcement Shuts Down Phishing Service Provider

# data[].attributes.attachment_link.description
On April 18, 2024, the UK's Metropolitan Police Service and others conducted an operation that succeeded in taking down the Phishing-as-a-Service provider LabHost.

# data[].attributes.body
Sweet Bobby: My Catfish Nightmare is a documentary that released on the streaming platform Netflix on October 16 2024. This documentary released 3 years after the Tortoise podcast of a similar name, by investigative journalist Alexi Mostrous, gained large-scale attention. Both media detail the story of how Hakirat Kaur Assi - known simply as Kirat - was catfished over the course of almost a decade, brought on by someone she thought she could trust.

Catfishing, put simply, is when someone sets up a fake online identity and uses it to trick and control others. In the case of Kirat, this was perpetrated by her cousin. Simran Bhoga.

Simran posed as a multitude of different characters, the main of them being a man named Bobby. Over the span of almost 10 years, 'Bobby' and Kirat would form a deep emotional connection, eventually leading to a romantic relationship.

The presence of catfishing in romantic settings is extremely common, so much so that there are multiple online forums dedicated to things like common signs of catfishing and how to prevent it from happening to you. One tip often given is to meet up early on in the relationship, and for Kirat, this is what eventually exposed the truth surrounding 'Bobby.'

As Kirat's relationship with 'Bobby' progressed over the years, multiple things would occur to further deepen the emotional investment between the two. Cheating, divorces, and near-death experiences experienced by 'Bobby' would strengthen Kirat's care for the man, leading to the two spending a large amount of time together.

Simran used coercive control to tighten the hold she had on Kirat, using emotional manipulation and constant cyber harassment to isolate her from her family. Isolation like how Kirat experienced is a major tactic used in both the digital and terrestrial world by abusers. It creates a sense of reliance and entrapment that is hard to break free from, further perpetuating the abusive behaviour. Often, this abuse leads to suicidal thoughts and chronic feelings of hopelessness.

Despite the emotional turmoil experienced by both Kirat and the real people Simran impersonated while talking to her, there was not a criminal case. Catfishing itself is not considered a criminal offence, and instead, the catfisher might be prosecuted for other crimes associated with it.

This places catfishing into the realm of digital harms, and makes justice for victims of it extremely difficult to achieve outside of potential civil compensation.

# data[].attributes.attachment_link.title
Sweet Bobby: My Catfish Nightmare | Official Trailer | Netflix