Chapter Twelve: Craigslist ads targeting job seekers in the mid-Atlantic

The QuantumFilament hackers, or one of their customers, post fake job, real estate and car ads to Craigslist. These advertisements have the following common characteristics:

  • Target audience is in Virginia, Maryland, Pennsylvania or Washington, DC
  • Contains no hyperlink and no specific reply instructions
  • Registers with Hotmail or Yahoo e-mail addresses
  • 16 of the 20 unique Hotmail addresses ended in four digits
  • All Craigslist passwords were 10 characters in length, all lowercase, seemingly random letters

Many ads appear to be copies of ads from legitimate companies. The fake ad poster periodically logged into the associated webmail accounts to check for replies to his fake Craigslist ads. In the instances in which this could be verified, no replies were ever sent by the fake ad poster. The poster simply received whatever replies he could get, the replies often including personal information and resumes. I hypothesize whatever personal information is volunteered by responders is reviewed for information that could be sold or exploited in the dark web, such as phone numbers, e-mail addresses, postal addresses, and identity information.

Date Title Notes Craigslist registration Craigslist password
2015-08-19

.NET custom Developer,SSRS Report Developer

sherillsxmehtalahh9353@hotmail.com

huwreslouc
2015-08-20 Full-Time Product Specialist – Worcester, PA A position at Grainger Industrial Supply, a real Fortune 500 company karenfwmontemaranomb9197@hotmail.com wriwriamou
2015-08-21 Accountant / Office Admin mitsukomashack5872@hotmail.com ueagaijeac
2015-08-21 Executive Assistant sherillsxmehtalahh9353@hotmail.com huwreslouc
2015-08-22 Microsoft Office Specialist/Quickbooks Instructor – PT A position at ASI Career Institute, a real organization sabrartgroverce1616@hotmail.com wraiheathu
2015-08-24 Automotive Dealership Cashier karenfwmontemaranomb9197@hotmail.com wriwriamou
2015-08-25 Dining Services Captain sabrartgroverce1616@hotmail.com wraiheathu
2015-08-25 Financial Crimes Lead A position at Barclaycard US, a large financial institution stefaniozwilkinsib0764@hotmail.com sofraicrio
2015-08-27 Kitchen Manager A position at Del Frisco’s Grille, a restaurant chain with 22 locations nationwide karenfwmontemaranomb9197@hotmail.com wriwriamou
2015-08-28 Client Services Specialist A position at Survivors, Inc., in Gettysburg, PA herminekemarzulloxn0378@hotmail.com kianicifri
2015-08-28 Administrative Assistant I – Immediate mitsukomashack5872@hotmail.com ueagaijeac
2015-08-28 Spacious 1br Apartment, New Floor, Fresh Paint andrastaines4612@hotmail.com uaegurioth
2015-08-31 Legal Secretary-Northern Virginia mitsukomashack5872@hotmail.com ueagaijeac
2015-09-01 Front Desk Coordinator tereseriversa0689@hotmail.com roclaithou
2015-09-02 CamRY SHiFtKSh 2000 toYotA eveleenmonari@yahoo.com
2015-09-04 Renovated Home For Rent/lease, A Quiet Community okskerlp0141@hotmail.com frephaecri
2015-09-04 Interior Specialist Sales Associate’s – Part Time A position at Arhaus Furniture, a real furniture store chain tomokowzmegeryz9314@hotmail.com lotastiowr
2015-09-04 NICEgPrp HoNDa ciVIC LX 2005 franceesbootyr@hotmail.com
2015-09-04 woRkSzCqAc CamrY 2000 sILVEr TOYotA pettifordbaimazz@hotmail.com
2015-09-06 Automotive Sales Consultant – Auto Sales Representative A position at Frankel, a chain of car dealerships in Maryland anniesouffrontf2260@hotmail.com slacihaica
2015-09-06 20oo ford ranger lOwEUaXo moritaxaviararx@hotmail.com
2015-09-06 98 jeep grand cherokee ownErzSoIT unraudefilippolw@hotmail.com
2015-09-06 Administrative Support Specialist Needed! delphinevotrumbovoh5087@hotmail.com
2015-09-06 Senior Meeting Planner tereseriversa0689@hotmail.com roclaithou
2015-09-07 Safe and quiet neighborhood, comprehensive list or homes jerryzmmullinaxse4049@hotmail.com jadaprouha
2015-09-08 Assisted Living Administrator A position at Asbury Methodist Community, a retirement community in Maryland mirnacastronovo8246@hotmail.com pheacaeuou
2015-09-11 Payroll Specialist A position at paychex, Inc., a real company ossieotdelmonacogh5782@hotmail.com hiolabuvod
2015-09-12 Dining Server A position at Brightview Senior Living, a retirement community tomokowzmegeryz9314@hotmail.com lotastiowr
2015-09-12 Technician / Automotive Mechanic A position at Mercedes Benz of Owings Mills, Maryland moriahdrsherrickib6713@hotmail.com gelouuouci
2015-09-13 Finance & Insurance Manager / Automotive Finance Manager A position at MileOne, Herb Gordon Volvo Subaru, a car dealership in Maryland mirnacastronovo8246@hotmail.com pheacaeuou

The following passwords were used to log into some of the Yahoo.com webmail accounts. The characteristics of passwords can be used to profile the user behind the activity.

  • wgijzMD22
  • bmoy2Oic5e
  • audoiv19A
  • dyYkt3ca4
  • qLRgdR44lNE
  • wgertUD44
  • erE2fs7f
  • ik4gAg5u
  • vsum0uK4c
  • uckfpJT65

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s