Logpresso Links CrowdStrike-Disclosed Telegram Account to DDoS Group VITAS

Logpresso released an analysis suggesting that the Telegram account YY520CN, which CrowdStrike disclosed in its financial-sector hacking report, may belong to a member of the Chinese DDoS-for-hire organization GodNet/VITAS. According to datanet.co.kr, Logpresso identified the account as a community supervisor of the service.

Logpresso also found that HangHang2017, a member of the same group, was infected with infostealer malware in 2023, leaving multiple traces. Through tracking Telegram posts, Logpresso found a 2024 VITAS group organizational chart listing YY520CN as supervisor and HangHang2017 as community supporter.

Logpresso determined that HangHang2017 was responsible for infrastructure management within the VITAS group, operating social media accounts, emails, domains and a Microsoft 365 tenant. The company identified HangHang2017's email address on GitHub and found leaked authentication traces in infostealer logs collected long-term from the dark web.

Logpresso stated that the attacker targeted externally exposed supplementary services such as loan inquiries and mobile work support rather than core systems.

Earlier CrowdStrike disclosure

CrowdStrike named a suspect in a financial-sector hacking case, and that person claimed their mobile phone number was stolen and denied involvement. In 2023, HangHang2017 was infected with infostealer malware, leaving multiple traces.