Pierluigi Paganini July 13, 2020

Hacker claims to have stolen more than 8,200 databases from the US cyber security firm Night Lion Security.

Hacker claims to have stolen more than 8,200 databases from the US cyber security firm Night Lion Security. The hacker is using the moniker “NightLion,” which is the name of the hacked company.

The databases are the back-end behind the DataViper a data leak monitoring service managed by the popular researcher Vinny Troia.

Night Lion Security scans the dark web, hacking forums, paste sites, and other cybercrime marketplaces for information that had been stolen from other companies.

The databases contain billions of records stolen and leaked from other companies during past security breaches.

Data breach monitoring services allow customers of the company to determine if the data of its employees have been involved in a security incident.

The hacker shared evidence of the hack with tens of cyber-security journalists and experts.

“Earlier today, a hacker going by the name of NightLion (the name of Troia’s company), emailed tens of cyber-security reporters a link to a dark web portal where they published information about the hack.” reads a post published by ZDNet.

The hacker shared the link to an onion service containing the details of the hack of the DataViper’s backend infrastructure he claims to have spent three months to exfiltrate the huge trove of data.

ZDNet published the full list of 8,225 databases provided by the hacker, along with 482 downloadable JSON sample files containing data allegedly stolen from the DataViper service. The hacker also published an additional proof of the intrusion to DataViper’s backend.

The hacker also started selling data about DataViper’s users in the Empire dark web marketplace.

Vinny Troia told ZDNet that the hacker gained access to one of the DataViper servers used for testing purposes.

Troia added that he believes the hacker is actually selling their own databases, rather than any information they stole from the company server.

According to Troia, the data leak was amassed by past data breaches associated with several threat actors, including GnosticPlayers, TheDarkOverlord, and Shiny Hunters.

“When people think they are above the law, they get sloppy. So much so they forget to look at their own historical mistakes. I literally detailed an entire scenario in my book where I allowed them to gain access to my web server in order to get their IPs. They haven’t learned. All they had access to was a dev environment.” Troia told ZDNet. “Much like the grey Microsoft hack which they recently took credit for, all they had was some source code that turned out to be nothing special, but they hyped it anyway hoping to get people’s attention. These are the actions of scared little boys pushed up against a wall facing the loss of their freedom.”

Pierluigi Paganini

(SecurityAffairs – hacking, Night Lion)

[adrotate banner=”5″]

[adrotate banner=”13″]