Sponsored by

Report

Threat Actor Dossier: Greasy Opal

Arkose Labs' threat intelligence unit, ACTIR, profiles Greasy Opal, an alleged cyber attack enablement business that public records place in the Czech Republic since 2009. It is not an attacker itself. It sells machine-learning tools that solve CAPTCHAs at scale, which buyers use to run volumetric bot attacks against account logins and to create fake accounts in bulk. The toolkit costs US$70 plus a US$10 monthly subscription, and ACTIR estimates the business earned at least US$1.7 million in 2023. ACTIR observed Storm-1152, the Vietnam-based group behind 750 million fake Microsoft accounts, using the tools; Microsoft's Digital Crimes Unit seized the group's domains in December 2023 and disrupted it again in August 2024 after it reconstituted. The dossier explains how the OCR and crowd-sourced model training work, which sectors are being targeted, from social media and gaming to banks and gig economy platforms, and the weakness that limits the tools: they run on CPUs rather than GPUs, so they scale poorly.