Probiv : an illegal service used for many purposes by Russian-speaking actors
Probiv – What is it and where it comes from ?
The Russian word “Probiv”, literally meaning to break through something, is used to advertise a type of illicit service on the Russian-language cybercriminal forums (RLCF). “Probiv” services are in fact a type of investigation that aims to gather as much information as possible about a person or a company thanks to the open-source searches and illegally obtained databases. The aim of a "Probiv" is for example to get the real identity of a target, map his presence on the Internet, obtain his credit record, address, phone numbers and other valuable personal information.
“Probiv” became a popular scheme on the RLCF during the second half of the 2010s. Only in Russia, according to the statistics of the Russian Judicial Department, 178 people were sentenced for the sale of personal data of their fellow citizens between 2016 and 2018 [1].
Different types of “Probiv” services can be found on cybercriminal forums. The most accessible ones are free Telegram bots that can query openly available or leaked databases. Premium service providers, who have created a lucrative business focused on this activity, are for their part obtaining information about targets in real time from insiders working for them. OWN-CERT observed that these insiders are generally recruited among the employees of mobile operators, banks, and state agencies such as law enforcement of the former USSR States. OWN-CERT also witnessed “Probiv” providers who publicized their capability to obtain personal data of citizens of European, American, or Asian countries.
Malicious actors offering to sell “Probiv” services are generally present on RLCF who allow their members to work on targets located in the former USSR (ed. Not all RLCF allow their members to attack companies or citizens of the former USSR). The most famous among them is the forum “Probiv” who is specialized in this craft and brings together a large number of malicious actors involved in this business. Telegram bots are another way of commercializing “Probiv” services, they will be discussed in the following pages.
While free and paid “Probiv” services are easy to find, the goals of customers and the information that is sought can be different.
Finding any information for any purposes
Customers of Probiv services – a substantial variety of motivations – from deanonymizing a rival hacker to catching a cheating spouse
Motivations for purchasing "Probiv" services and the type of information a client is looking for are closely linked. According to OWN-CERT’s observation clients of Probiv services are often malicious actors involved in schemes such as fake documents creation or banking fraud.
Deanonymizing a rival threat actor or business owner can also be handy to blackmail them or to destroy their reputation. Doxing is indeed widely used as a weapon by Russian-speaking threat actors. The famous threat actor Mikhail Pavolovich Matveev, a.k.a. “Wazawaka”, who was recently sanctioned by the United States because he is a “key actor in the Russian ransomware ecosystem” [2], was himself doxed in 2009 when he just began his hacking activities [3].
A recent example of doxing implying the use of “Probiv” service occurred on the 1st of March 2023, when the administrators of the Russian-language drug marketplace Kraken deanonymized three developers of Solaris, a rival drug marketplace. Kraken then released a document containing personal information of Solaris’ employees. It included their passport numbers, ID photos, addresses, current location, phone numbers, email addresses and aliases. All this data could have not been gathered without access to databases belonging to the Russian administration.
Politically motivated activists, journalists and opposition leaders have as well used “Probiv” services to conduct their investigations. It was for example the case of the Russian politician Alexey Navalny, whose team allegedly purchased “Probiv”services to identify the Federal Security Service agents reportedly involved in his poisoning [4].
Eventually, customers of “Probiv” services can be common people such as a spouse wishing to identify if his or her partner is present on dating app.
Information that can be found by Probiv operators – from credit history to the authorization to leave the country
The number of details and the type of available data that can be obtained through “Probiv” depends on the target’s country. According to the observations of OWN-CERT, Russia, Ukraine, Belarus and Kazakhstan are the most frequently mentioned countries where “Probiv” service providers can find information. Other countries, as the EU member States are nevertheless also targeted although not as extensively as Russia.
In the former USSR countries “Probiv” services can obtain almost all personal information from any bank or mobile phone provider. Almost any administrative databases, including the ones belonging to the police are as well accessible for these malicious actors.
(Automatically translated from Russian)
(Automatically translated from Russian)
Since the beginning of the “Special military operation” in February 2022, some Russian citizens are afraid of being mobilized and sent to the war in Ukraine. “Probiv” sellers are exploiting this situation and are selling for 15,000 roubles (172 euros – May 2023) information about travel bans.
Almost any public database is available for “Probiv” for a few thousand roubles. Currently “Probiv” services have for example access to databases of the Ministry of Interior of Russia, the pension fund, the federal tax system and many others.
(Automatically translated from Russian)
Some malicious actors are also selling personal information of EU citizens. Interpol and Europol seem to be infiltrated by insiders working for “Probiv” service providers. It is also possible to identify if a person possesses citizenship of an EU State, a banking account or real estate.
(Automatically translated from Russian)
Now that we have seen some of the most common types of services that can be obtained through a “Probiv” provider let’s try to understand how these illegal services operate.
The mechanisms behind the Probiv business – stolen databases, insiders and telegram bots
Access to an extensive amount of personal information is possible thanks to a constant gathering of leaked and stolen databases. Furthermore, “Probiv” service providers are permanently recruiting insiders from the administration, law enforcement agencies and private businesses.
Probiv providers’ constant quest for new databases and insiders
Aggregation of leaked personal information and purchase of newly stolen and leaked data is a permanent necessity for “Probiv” service providers. Below a section of the forum Dublikat is dedicated to the sale of databases.
(Automatically translated from Russian)
These databases can belong to shops or banks and telecom companies, or even online trading brokers.
The recruitment of insiders is another criterion of success for “Probiv” service providers, as it allows them to obtain almost any type of information about a citizen of a country of the former USSR.
Several cybercriminals do not hesitate to try to recruit officials from Europe. Interpol and Europol employees are among the personnel that are looked for. Moreover, online payment services, social networks, and instant messenger companies areas well targeted by threat actors wishing to recruit insiders.
(Automatically translated from Russian)
Telegram “OSINT”and “Probiv” bots – the democratization of deanonymization services
Once the data is gathered, “Probiv” service providers have several ways to monetize it. Lately Telegram has become a powerful tool for all types of cybercriminals, as it not only offers a way to communicate easily but is also an automation tool. Instead of handling every client directly some malicious actors have decided to simply create a bot and sell automatically queries for a dozen roubles.
These Telegram bots could be a useful OSINT tool for investigators looking for data about a target located in eastern Europe. Indeed, while owners of "Probiv" Telegram bots do not contact insiders to gather data about a particular target, their services are also much cheaper and offer access to leaked and stolen databases containing Personal Identifiable Information. Generally, this kind of bot can search for an email, a name, a phone number, an IP address, an alias or even a numberplate. The advantage of these bots is their ability to gather substantial amounts of data in one place. Nevertheless, passwords are usually not included in the results, and for some paid bots a Telegram account created with a Russian phone number is necessary.
OWN-CERT has recently published on its Twitter account a list of 10 Telegram bots that are used to find personal data. Do not hesitate to have a look if you want to learn more!
One of these Probiv/OSINT Telegram bots is the infamous Eye of God, created by the Russian citizen Mr. Evgenii Viacheslav Antipov [5], but that is a story for another time.
[1] ‘“Пробить по-быстрому”: кто и как сливает личные данные россиян’, BBC News Русскаяслужба, 25 April 2019, https://www.bbc.com/russian/features-48037582.
[2] ‘Alleged Babuk Ransomware Gang Leader “Wazawaka” Indicted,Sanctioned by US’, accessed 17 May 2023, https://therecord.media/alleged-babuk-ransomware-leader-sanctioned-and-indicted-by-us.
[3] ‘ДДОСФорума. Надо Наказать Виновного.’, ANTICHAT - Security online community,accessed 8 October 2022, https://forum.antichat.com/threads/128304/.
[4] ‘“Пробивщики”, передавшие Навальному данные для расследований,получили сроки’, BBC News Русская служба, accessed 17 May 2023, https://www.bbc.com/russian/news-60351641.
[5] ‘«Еслинужно будет рассказать, как кто-то из вас нарушает закон, я это сделаю»Интервью создателя «Глаза Бога» Евгения Антипова — об отравлении Навального,сотрудничестве с силовиками и грядущей войне с Telegram’, Meduza, accessed 1June 2023, https://meduza.io/feature/2021/07/12/esli-nuzhno-budet-rasskazat-kak-kto-to-iz-vas-narushaet-zakon-ya-eto-sdelayu.
