Chapter Twelve: Craigslist ads targeting job seekers in the mid-Atlantic

The QuantumFilament hackers, or one of their customers, post fake job, real estate and car ads to Craigslist. These advertisements have the following common characteristics:

  • Target audience is in Virginia, Maryland, Pennsylvania or Washington, DC
  • Contains no hyperlink and no specific reply instructions
  • Registers with Hotmail or Yahoo e-mail addresses
  • 16 of the 20 unique Hotmail addresses ended in four digits
  • All Craigslist passwords were 10 characters in length, all lowercase, seemingly random letters

Many ads appear to be copies of ads from legitimate companies. The fake ad poster periodically logged into the associated webmail accounts to check for replies to his fake Craigslist ads. In the instances in which this could be verified, no replies were ever sent by the fake ad poster. The poster simply received whatever replies he could get, the replies often including personal information and resumes. I hypothesize whatever personal information is volunteered by responders is reviewed for information that could be sold or exploited in the dark web, such as phone numbers, e-mail addresses, postal addresses, and identity information.

Date Title Notes Craigslist registration Craigslist password

.NET custom Developer,SSRS Report Developer

2015-08-20 Full-Time Product Specialist – Worcester, PA A position at Grainger Industrial Supply, a real Fortune 500 company wriwriamou
2015-08-21 Accountant / Office Admin ueagaijeac
2015-08-21 Executive Assistant huwreslouc
2015-08-22 Microsoft Office Specialist/Quickbooks Instructor – PT A position at ASI Career Institute, a real organization wraiheathu
2015-08-24 Automotive Dealership Cashier wriwriamou
2015-08-25 Dining Services Captain wraiheathu
2015-08-25 Financial Crimes Lead A position at Barclaycard US, a large financial institution sofraicrio
2015-08-27 Kitchen Manager A position at Del Frisco’s Grille, a restaurant chain with 22 locations nationwide wriwriamou
2015-08-28 Client Services Specialist A position at Survivors, Inc., in Gettysburg, PA kianicifri
2015-08-28 Administrative Assistant I – Immediate ueagaijeac
2015-08-28 Spacious 1br Apartment, New Floor, Fresh Paint uaegurioth
2015-08-31 Legal Secretary-Northern Virginia ueagaijeac
2015-09-01 Front Desk Coordinator roclaithou
2015-09-02 CamRY SHiFtKSh 2000 toYotA
2015-09-04 Renovated Home For Rent/lease, A Quiet Community frephaecri
2015-09-04 Interior Specialist Sales Associate’s – Part Time A position at Arhaus Furniture, a real furniture store chain lotastiowr
2015-09-04 NICEgPrp HoNDa ciVIC LX 2005
2015-09-04 woRkSzCqAc CamrY 2000 sILVEr TOYotA
2015-09-06 Automotive Sales Consultant – Auto Sales Representative A position at Frankel, a chain of car dealerships in Maryland slacihaica
2015-09-06 20oo ford ranger lOwEUaXo
2015-09-06 98 jeep grand cherokee ownErzSoIT
2015-09-06 Administrative Support Specialist Needed!
2015-09-06 Senior Meeting Planner roclaithou
2015-09-07 Safe and quiet neighborhood, comprehensive list or homes jadaprouha
2015-09-08 Assisted Living Administrator A position at Asbury Methodist Community, a retirement community in Maryland pheacaeuou
2015-09-11 Payroll Specialist A position at paychex, Inc., a real company hiolabuvod
2015-09-12 Dining Server A position at Brightview Senior Living, a retirement community lotastiowr
2015-09-12 Technician / Automotive Mechanic A position at Mercedes Benz of Owings Mills, Maryland gelouuouci
2015-09-13 Finance & Insurance Manager / Automotive Finance Manager A position at MileOne, Herb Gordon Volvo Subaru, a car dealership in Maryland pheacaeuou

The following passwords were used to log into some of the webmail accounts. The characteristics of passwords can be used to profile the user behind the activity.

  • wgijzMD22
  • bmoy2Oic5e
  • audoiv19A
  • dyYkt3ca4
  • qLRgdR44lNE
  • wgertUD44
  • erE2fs7f
  • ik4gAg5u
  • vsum0uK4c
  • uckfpJT65

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s