Kapusta.World: The fiendish cabbage exemplifying cybercriminal marketing in the modern era

Over the last few months, the Russian-language cybercriminal landscape has been invaded by cabbages. Or, specifically, one rather friendly-looking cabbage offering to fulfill threat actors’ every need relating to fraudulently acquired information. Since last fall, the threat actor behind a new service called “Kapusta.World” has diligently worked to advertise their offerings across multiple Russian-language forums. The appearance of the service provides interesting insight into both threat actors’ perception that there is still a need for new services offering fraudulently acquired information within the cybercriminal community as well as the potential go-to-market strategies that vendors can employ to promote their offerings.

Kapusta Logo

Kapusta (which translates from Russian as “cabbage” and is also, rather aptly, sometimes used as a slang term for “money”), describes itself as “a trading platform for the sale of ACCOUNTS with balances/subscriptions and many other goods and services from various fields of activity”. The service operates in two main branches, with one offering account credentials and the other offering an information look-up, or “probiv”, service.

Kapusta’s accounts offering

Kapusta’s accounts section offers account credentials for a range of organizations spanning multiple sectors, including:

• websites selling coupons
• online retailers
• cinemas
• food delivery services
• airline and hotel websites
• VPN services
• cybercriminal sites selling credit card and personal information

Most of the accounts on offer relate to Russia-based businesses, but the stock list also contains accounts for international organizations, especially in the travel sector, and the cybercriminal platforms listed all contain data relating to victims located in multiple geographies.

Kapusta dedicated thread on XSS forum

The Kapusta advertisements promise that if interested buyers cannot find the accounts they need listed, the service will try its best to source the required accounts. In a nod to generous customer service, Kapusta’s advertising material also contains links to a document detailing how best to abuse the compromised credentials, with bespoke advice tailored to making the most profit from each individual victim organization.

Kapusta’s information look-up offering

The second element of Kapusta’s offering is a “probiv” service. Essentially, it allows threat actors to provide a piece of personal data belonging to an individual and, in return for a fee, receive other information associated with this target. Kapusta’s service offers buyers the chance to query passport information belonging to Russian Federation citizens and also, depending on the target, could provide data relating to tax payments, criminal/administrative offenses, place of work, income and debts, and property. The service costs 800 Rubles (approximately $12 USD) for a comprehensive information look-up on one target.

Kapusta’s marketing strategy

Kapusta.World is not unique. Services selling similar offerings are ten-a-penny on Russian-language cybercriminal forums. What is interesting, though, is the way in which Kapusta burst onto the scene, replicated its presence across multiple forums, and focused on professional branding and customer service options.

Distribution across or within cybercriminal forums

The earliest posts advertising the Kapusta service that Digital Shadows (now ReliaQuest) found dates from November 2019. Although several of Kapusta’s forum posts state that they have been working for “more than 2 years”, it may be that the service in its current format only appeared last fall.

Since launching advertising threads on a number of forums in November 2019, Kapusta has continued to grow its presence within the cybercriminal underground, most recently popping up on the increasingly prominent Russian-language forum XSS in January 2020. This development is significant: Until appearing on XSS, Kapusta had mainly advertised their services on “lower tier” Russian-language forums that have lower barriers to entry and tend to trade in goods and services with lower monetary values. XSS, run by the former administrator of possibly the most high-profile Russian-language forum, Exploit, represents a step up in terms of the level of criminality and value of the trade taking place on the site.

Kapusta’s profiles on several different Russian-language cybercriminal forums

Kapusta has historically used the same wording in their posts across numerous different forums, with their advertisements split across separate threads advertising the two different branches of the business. Kapusta has updated their threads frequently, updating the threads with notifications of new stock or simply with messages of “up” to maintain the threads’ prominence in forum listings.

At the end of February 2020, Kapusta initiated a new thread, duplicated across the forums on which they are active. This thread brought together Kapusta’s disparate offerings into one advertisement, summarizing what the service provides as (translated):

• Brute-forced account with balances from various grocery stores and restaurants
• Brute-forced accounts with balances for travel firms, hotels, airlines etc.
• Brute-forced accounts with balances from building supply stores, hypermarkets
• Brute-forced accounts with paid subscriptions for VPN services, audio/video services etc.
• Brute-forced accounts for shadow shops/services
• License keys and subscriptions
• Configs for Linken Sphere [an antidetection browser] + cookies
• Hacking for emails and social networks
• Information look-up services
• LocalBitcoins accounts
• Discounts on your tariff plan for the Beeline operator [a Russian mobile phone operator]

Kapusta dedicated thread advertising probiv services on XSS forum

The seemingly constant search for new forums on which to advertise, as well as the decision to keep creating new threads on forums on which Kapusta already has a presence, indicates that the threat actor behind the service is not content to sit still and wait for the adverts to provide the traffic for their service. Instead, they appear to be constantly evolving their marketing strategy, testing out new advertisement wording and new sites in a permanent drive for new users.

Many threat actors offering similar services do not display this much innovation: Once they have established themselves on a few different platforms, it is not uncommon for users advertising services to rely on their initial posts to attract buyers. The timings of Kapusta’s replicated posts across forums also varied – it is not the case that once a new post wording had been developed, it was rolled out across all the forums on the same day. This suggests a period of experimentation, with Kapusta potentially assessing the impact of their posts before duplicating them more widely.

Professional branding

The threat actor behind Kapusta has clearly prioritized the branding element of their service. Kapusta has a custom logo that the majority of the accounts representing the service on Russian-language cybercriminal forums use as their avatar. The logo is bright, professionally drawn, and humorous, meaning it would stand out from the crowd on a forum amongst a long list of threads. Kapusta has also used customized versions of the logo on its various Telegram channels, as shown in the images below.

The continuity in the service’s branding across multiple different platforms will help the offering to appear more legitimate in the eyes of potential service users within the cybercriminal community. In a world in which everyone is anonymous, it is difficult to know who to trust and which services can be relied upon to deliver to buyers the goods that they have purchased. Many scammers on cybercriminal forums looking to deceive their fellow forum members are looking for quick wins: They are less likely to invest time and money in professional graphics. Kapusta’s “look” will likely increase its legitimacy in the eyes of its desired user base.

Kapusta’s consistent branding across its Telegram channels

Emphasis on customer service

The threat actor behind Kapusta appears to have set a great store by providing exceptional customer service. In their consolidated advertising thread, replicated across cybercriminal forums at the end of February 2020, Kapusta promoted their “personal approach to each client”, emphasizing the fact that each account their service offers is manually verified and that the stock list is constantly replenished.

Kapusta has also tried to make it as easy as possible for potential buyers to get in touch with them, no matter what their preferred method of contact. Their posts give contact details for ICQ, Skype, a Telegram channel, email, and a website (although at the time of writing the website redirects to the Telegram channel). Kapusta has even established an automated Telegram sales bot (pictured below), an increasingly popular tool used by cybercriminal vendors to provide a user-friendly interface for potential buyers to source the goods or services in which they are most interested.

Kapusta’s automated Telegram bot interface

At the end of February 2020, Kapusta announced that their previously established Telegram channels had been blocked “without explanation” and updated each of their threads with the new Telegram channel details. Kapusta has promoted Telegram as their preferred method of communication, promising to always be available on this platform in contrast to their once-daily visits to forums. Their previous posts have also promised “free giveaways” on the Telegram channel, likely in an effort to attract users to join their channel.

Only Time Will Tell …

Nothing that Kapusta is doing here is particularly unique. Other services have exemplified an emphasis on customer service, a wide cybercriminal presence, and custom branding in the past. However, it is interesting to see a newly launched brand employing all these tactics in a multi-pronged assault on the cybercriminal market. Only time will tell how successful Kapusta’s obvious efforts will be. The service has been verified by moderators on several different Russian-language forums, and its dedicated threads feature positive reviews from happy buyers. It remains to be seen, though, whether all of this will help to differentiate Kapusta from the many other accounts/probiv services available to discerning Russian-speaking buyers.