Data Broker Disruption Shows Chinks in Armor of Evasive Cyber Actors Through Legal Actions
Attack Summary
The complex legal challenges facing Radaris.com, a prominent data broker, reveal a significant attack vector leveraging judicial mechanisms to combat exploitation of personal information. The New Jersey-based Atlas Data Privacy Corp initiated litigation against Radaris, claiming violations of the state’s stringent Daniel’s Law, which mandates the removal of personal information regarding law enforcement and governmental personnel from data broker platforms. In a notable turn of events, the court has begun transferring domains associated with Radaris to Atlas, effectively disrupting its operations. Though the initial breach involves civil litigation rather than a cyber attack in the traditional sense, the failure of Radaris to respond adequately and the subsequent court rulings illustrate an increasing vulnerability among data brokers to legal recourse designed to enforce privacy protections.
Tactics, Techniques, and Procedures (TTPs)
Radaris utilized evasive tactics that align with known behaviors of sophisticated threat actors in cybersecurity. It employed the following techniques from the MITRE ATT&CK framework:
- T1583 — Acquire Infrastructure: Radaris operated through a rotating cast of corporate fronts and entities in jurisdictions perceived as favorable for evasion (e.g., the Marshall Islands, British Virgin Islands).
- T1090 — Communication via Non-Standard Ports: After rebranding and restructuring, Radaris obscured the true nature of its operations by manipulating its terms of service and creating nested layers of ownership.
- T1518 — Software Discovery: The “island-hopping” tactic utilized multiple companies, under various names, to manage domains and services while obfuscating true ownership, potentially hiding from regional legal jurisdictions.
- T1548 — Abuse Elevation Control Mechanism: The company’s representatives attempted to prevent legal repercussions through procedural delays and challenges, thus trying to evade accountability for violations of privacy laws.
By distorting public face and maintaining constant changes within corporate structures, Radaris exemplified how cyber actors can use legal fictions as a persistence mechanism against enforcement efforts.
Threat Actor Context
The Lubarsky brothers, Igor and Dmitry, who are the alleged operators of Radaris, have cultivated a reputation for operating multiple data broker services with questionable ethics. Their history points to a reliance on manipulation and avoidance of accountability, with their operations often characterized by permanent structural shifts intended to evade regulation and litigation. The combination of legal threats against investigative reporters indicates a highly reactive stance to scrutiny. Their geopolitical background—immigrants from Russia—coupled with their operations focused within the U.S., reflects a possible complex motivation where profit takes precedence over ethical considerations and personal privacy compliance. This background suggests attributes typical of sophisticated actors operating under the radar.
Indicators of Compromise (IOCs)
Specific IOCs associated with Radaris include the domains affiliated with various corporate names they employed, such as Bitseller Expert Limited, Digital Orbit Corp, and Veripages.com. The newly identified entities are critical for tracking their operations and could include the following speculative indicators:
- Email domains associated with difive.com and its successors.
- Financial transactions linked to accounts that manage operations across multiple domain holdings under one central management.
Defenders should be alert for abrupt changes in domain registrations or service terms that might indicate attempts to obfuscate continuity in operations.
Detection and Hunting Guidance
Security teams should monitor for behaviors consistent with attempts to evade legal scrutiny or disrupt compliance frameworks:
- Log sources: Analyze web traffic logs and domain registration changes closely for rapid changes in ownership or registered entities. Look specifically at any domain age discrepancies which may indicate newly formed entities being created hastily to mask operations.
- SIEM Query Example: “SELECT * FROM domain_logs WHERE domain_name ‘LIKE’ ‘radaris%’ AND REGDATE > TIMESTAMP_SUB(NOW(), INTERVAL 1 MONTH) ORDER BY REGDATE DESC;”
- EDR Signals: Enable alerts for alterations in cloud service configurations, particularly around data handling policies that may signal attempts to change compliance mandates.
- Investigate anomalies in user access patterns across different related services and correlate changes in user terms and notices back to external investigations or legal inquiries.
Mitigation Recommendations
Organizations should proactively protect themselves and build a resilient posture:
- Implement Strong Identity Verification: Ensure that service providers verify the identity and ownership of domains and associated services pertinent to data processing.
- Regular Audit of Third-Party Relationships: Continually audit and assess relationships with data brokers. Implementation of comprehensive data management audits can yield insights on corporate structures.
- Legal Preparedness: Establish access to legal counsel who can swiftly navigate various regulatory environments and take action against non-compliant firms.
- Enhance Public Information Security: Collaborate with regulators and advocacy groups to initiate and support stricter legislations that close gaps on privacy vulnerabilities exploited by data brokers.
Full Circle Cyber Analyst Takeaway
The disruptions faced by Radaris underscore the pressing need for organizations to recognize non-cyber avenues for potential data exfiltration and exploitation. The evolving threat landscape suggests that nefarious actors will increasingly leverage legal loopholes, necessitating coordinated responses from both private entities and regulators to address systemic liability in the data broker industry. Organizations should remain vigilant, anticipating that evasive maneuvers will likely continue while long-term safeguards against such practices are debated legislatively.
