The compromised accounts were detected by Israeli intelligence firm KELA, which specialises in dark web threat intelligence and offers its clients a real-time dark web search engine called Darkbeast.
KELA threat intelligence team leader Elad Ezrahi said the MyGov accounts were extracted from more than 2000 compromised computers, or “bots”. Botnets are networks of compromised machines controlled by a single actor.
“The threat actors behind these platforms probably obtain this data either by running their own botnet infrastructure … or by buying compromised credentials from other actors,” Mr Ezrahi said.
“The data can be used by an attacker for various malicious activities, depending on the attackers’ motives.
“For example, an attacker who purchases a bot, with compromised account/s for the my.gov.au portal, can use the victim’s data for identity theft, and conduct various fraudulent activities.”
Mr Jongen said if people suspect their MyGov accounts have been compromised, they should contact the Scams and Identity Theft Helpdesk.
“This team can quickly revoke an account and unlink member services to prevent further access,” he said.
Logins seen by The Australian Financial Review include banks, government services, telcos and e-commerce stores. The most recent data was from late May 2020. For legal reasons no data was purchased to confirm authenticity.
The coronavirus pandemic has proved a boon for hackers as millions of employees moved to remote-working, with intelligence firm Cybel reporting more than 500,000 Zoom accounts are available for sale online.
Privacy Affairs Dark Web Price Index reveals the average prices for a range of products for sale on the dark web, including forged passports ($US1500), driver licenses ($US550), credit cards ($US35) and email accounts ($US155).
The Australian Signals Directorate’s Australian Cyber Security Centre issued an alert in November reporting a rise in the use of botnet-related malware.
“The ACSC has received reports of Emotet [malware] being spread through both untargeted bulk spam emails, as well as what appear to be highly targeted spear-phishing emails,” the advisory said.
“Upon infection of a machine, Emotet attempts to spread within a network by brute-forcing user credentials, and writing to shared drives. Emotet often downloads a secondary malware, called Trickbot, onto infected machines.
“Trickbot … allows an attacker to harvest emails and credentials … The ACSC is aware of a number of Emotet/Trickbot infections leading to ransomware attacks”.
The Financial Review has reported on a range of high profile ransomware attacks in recent months, including on BlueScope, Toll and Lion.
