Home Cyber Security Telekopye: Chamber of Neanderthals’ secrets and techniques

Telekopye: Chamber of Neanderthals’ secrets and techniques

0
Telekopye: Chamber of Neanderthals’ secrets and techniques

[ad_1]

We lately revealed a blogpost about Telekopye, a Telegram bot that helps cybercriminals rip-off folks in on-line marketplaces. Telekopye can craft phishing web sites, emails, SMS messages, and extra.

Within the first half, we wrote about technical particulars of Telekopye and hinted at hierarchical construction of its operational teams. On this second half, we deal with what we have been capable of study Neanderthals, the scammers who function Telekopye, their inside onboarding course of, totally different tips of commerce that Neanderthals use, and extra.

Key factors of this blogpost:

  • How aspiring Neanderthals be a part of Telekopye teams.
  • Detailed view of the entire scamming operation from the Neanderthals’ perspective.
  • Evaluation of the rip-off situations and what every Neanderthal has to do as a way to achieve success.
  • The instruments utilized by senior Neanderthals.
  • Insights into tips that Neanderthals use to lure their victims.
  • Highlights from an interview with one of many Telekopye directors.

Overview

Not too long ago, we revealed an evaluation of Telekopye; on this follow-up blogpost, we deal with the Neanderthals’ techniques and modus operandi. Our info comes from three foremost sources:

  1. supply code of the bot itself,
  2. evaluation of Neanderthals’ conversations from scamming teams we’ve infiltrated, and
  3. our evaluation of Neanderthals’ inside documentation – a group of paperwork, graphs, footage, and extra – that they use as their very own private data base. Such info is supplied to newcomers to assist them with onboarding.

We’d additionally wish to thank Flare, who helped us in our analysis.

Becoming a member of a gaggle

Telekopye teams recruit new Neanderthals by way of ads in many alternative channels, together with underground boards. These ads clearly state the aim: to rip-off on-line market customers, as seen in Determine 1.

Figure 1 Recruitment Telekopye scamming group
Determine 1. Recruitment for a Telekopye scamming group

Aspiring Neanderthals are required to fill out an software, answering primary questions like the place they realized concerning the group and what expertise they’ve on this line of “work”. If accredited by present group members with sufficiently excessive position, the brand new Neanderthals can begin utilizing Telekopye to its full extent. Moreover, each Neanderthal is required to affix two channels: a gaggle chat the place Neanderthals talk and the place guidelines and manuals are stored, and a separate channel the place transaction logs are stored. The method is demonstrated in Determine 2.

Figure 2 Application accepted
Determine 2. Accepted software that permits a brand new Neanderthal to affix group chat and transaction logs chat by way of hyperlinks within the message

Kinds of scams

There are three foremost rip-off situations:

1. Vendor, internally known as 1.0.

2. Purchaser, internally known as 2.0.

3. Refund.

Determine 3 is the creation menu for the primary two rip-off situations, the place column 1 on the backside represents Vendor scams (1.0). The Refund rip-off situation is then tied to every rip-off situation individually. These rip-off varieties are described within the following subsections.

Figure 3 Example of creation menu
Determine 3. Instance of creation menu for various rip-off situations

Vendor rip-off

On this situation, Neanderthals pose as sellers and attempt to lure unsuspecting Mammoths into shopping for some non-existent merchandise. When a Mammoth exhibits curiosity within the merchandise, the Neanderthal persuades the Mammoth to pay on-line relatively than in individual. If the Mammoth agrees, the Neanderthal offers a hyperlink to a phishing web site supplied by Telekopye and punctiliously crafted to resemble the cost web page of the legit on-line market itemizing the reputed merchandise. In contrast to the legit net web page although, this web page asks for a web based banking login, bank card particulars (generally together with steadiness), or different delicate info. If the Mammoth enters this information, the phishing web site routinely steals it. Apparently, this information doesn’t turn out to be obtainable to the Neanderthal providing the merchandise on the market, however is processed by different Neanderthals. Determine 4 exhibits the Telekopye menu with already created phishing hyperlinks and Determine 5 demonstrates the communication throughout this rip-off situation.

Figure 4 Example of phishing links
Determine 4. Instance of phishing hyperlinks created by Telekopye for the Vendor rip-off situation
Figure 5 Fabricated example
Determine 5. Fabricated instance of dialog for the Vendor rip-off situation

Purchaser rip-off

On this situation, Neanderthals pose as patrons and so they analysis a Mammoth to focus on. They present curiosity within the merchandise a Mammoth is promoting and declare they already paid by way of the offering platform. The Neanderthals proceed to ship the Mammoths electronic mail or SMS messages (created by way of Telekopye) with a hyperlink to a rigorously crafted phishing web site (additionally created by way of Telekopye; see Determine 6), claiming the Mammoth must click on this hyperlink as a way to obtain their cash from the platform. The remainder of the situation is similar to the Vendor rip-off with slight variations throughout dialog (depicted in Determine 7).

Figure 6 Example of Buyer scam scenario
Determine 6. Instance of the Purchaser rip-off situation phishing web site
Figure 7 Example of conversation for Buyer scam scenario
Determine 7. Instance of dialog for the Purchaser rip-off situation

Refund rip-off

On this situation, Neanderthals create a scenario the place the Mammoth is anticipating a refund after which sends them a phishing electronic mail with a hyperlink to the phishing web site, as soon as extra serving the identical function. Neanderthals both ship such emails to Mammoths they didn’t contact earlier, relying on them getting grasping and attempting to get this “refund” or they mix it with the Vendor rip-off situation – when Mammoths complain that they didn’t obtain their items, Neanderthals ship them refund phishing emails in an try and rip-off them for a second time.

Modus operandi

Now that we have now described the totally different rip-off situations, let’s take a look at what data the Neanderthals have gathered all through the years of their operation. Their inside documentation consists of photographs, graphs, brief guides, and even advanced paperwork – the desk of contents of 1 such doc is illustrated in Determine 8.

Figure 8 Table of contents
Determine 8. Desk of contents from onboarding supplies (translated from Russian)

We additionally found that there are two sorts of Neanderthals. The primary form writes to each doable Mammoth and the opposite one is way pickier with regards to in search of a possible Mammoth. There’s a little bit of rivalry between them because the extra cautious form argues that the “reckless” conduct of the much less cautious scammers may carry a bit extra revenue, nevertheless it creates rather more public consciousness.

Preparation

Making ready for a rip-off differs primarily based on the chosen situation. For the Vendor rip-off situation, Neanderthals are suggested to arrange further images of the merchandise to be prepared if Mammoths ask for extra particulars. If Neanderthals are utilizing footage they downloaded on-line, they’re speculated to edit them to make picture search harder.

For the Purchaser rip-off situation, the important thing a part of a Neanderthal’s preparation is how they select the Mammoth. Over time, Neanderthals have created tips to comply with when selecting their targets – they think about gender, age, expertise in on-line marketplaces, ranking, critiques, variety of accomplished trades, and plenty of extra indicators.

Market analysis

In nearly each group of Neanderthals, we are able to discover references to manuals with on-line market analysis from which Neanderthals draw their methods and conclusions. The supply of this analysis is often a examine from 2017 by Avito and Knowledge Perception company. Determine 9 illustrates the outcomes of 1 such analysis, depicting graphs of gender, age, expertise, and earnings distribution on a selected on-line market.

Figure 9 Neanderthals’ analysis of typical buyer
Determine 9. Neanderthals’ evaluation of a typical purchaser (translated from Russian)

Throughout the Purchaser rip-off situation, Neanderthals select their targets primarily based on the kind of objects they’re promoting. As an example, some teams keep away from electronics utterly. Alternatively, cell units are a valued class for different teams. The value of the merchandise can be vital – if too excessive, then Neanderthals won’t goal such Mammoths, as they consider that the Mammoths’ vigilance will probably be a lot greater by default. Manuals suggest that Neanderthals, within the Purchaser rip-off situation, decide objects with a value between 1,000 to 30,000 rubles (€9.50 to €290 as of 20th October, 2023).

The placement of the Mammoth can be vital. Neanderthals focus extra on richer cities the place they anticipate extra listings and folks not conserving such a detailed eye on their very own funds.

Lastly, the scammers take the day of the month into consideration too. They purpose at days proper after folks obtain their paychecks, as they naturally anticipate they will have more cash of their financial institution accounts.

Net scraping

Neanderthals make the most of net scrapers to shortly go although many on-line market listings and decide an ideal Mammoth who will fall for the rip-off; that is, as we have now already written, an important preliminary a part of the Purchaser rip-off situation.

We aren’t conscious of customized net scrapers carried out by Neanderthals, however their documentation mentions a couple of provided as legit companies. Neanderthals scrape the focused market for listings, particulars of things, and person info, which ends up in a CSV or XML file. Neanderthals then use the outcomes to shortly discover the precise targets. We offer an instance of such a file in Determine 10.

Figure 10 Parsed info from Avito website
Determine 10. Parsed information from Avito web site within the class “cell phones” (translated from Russian)

Person scores and expertise are of explicit curiosity to Neanderthals, as they use this info to keep away from targets that they deem more likely to spot the rip-off.

Avoiding in-person supply

For security causes, many Mammoths desire each in-person cost and in-person supply for offered items. That poses a difficulty for Neanderthals as they should persuade Mammoths to agree to make use of a supply service and on-line cost, in order that they’ll direct them to the phishing web site. Often, they declare they’re too far-off or that they’re leaving town for a enterprise journey for a couple of days. On the identical time, they attempt to look very within the merchandise to extend the possibilities that the Mammoth will conform to their suggestion.

Phishing net web page hyperlink supply

Many legit on-line marketplaces have an built-in chat function and, alongside, moderation in place. Sending somebody a hyperlink by way of such a chat is often a crimson flag and will very effectively end in a ban. Neanderthals attempt to overcome this impediment by persuading Mammoths to proceed their dialog on a special chat platform that has much less monitoring.

Their arguments are similar to these in opposition to in-person supply. They declare that they should go away their residence and can’t entry the chat from their cell phone, however are capable of proceed their discuss on one of many chat apps.

By their very own statistics, Neanderthals declare that about 50% of Mammoths will conform to a platform change and 20% of these will fall for the rip-off. This leads to a ten% success fee general.

One other favored methodology of supply is utilizing electronic mail or SMS. Telekopye is ready to shortly generate convincing phishing messages. Neanderthals use tips (a few of them illustrated in Determine 11) to study Mammoths’ electronic mail addresses or cellphone numbers as a way to ship them such messages. The benefit of this strategy is that asking for a cellphone quantity or electronic mail handle will possible not set off any crimson flags for neither Mammoth nor chatting platform and the Neanderthal doesn’t want to influence the Mammoth to switch to a special chat platform.

Figure 11 Copy-n-paste text example
Determine 11. Copy-and-paste textual content instance (translated from Russian)

Communication

No AI is utilized by Telekopye. This can be stunning, however Neanderthals consider that their strategy is superior and fewer more likely to be noticed by monitoring mechanisms. Because of this, the huge portion of their inside documentation is targeted on communication methods to attain one of the best outcomes.

Incomes the Mammoth’s belief is essential to the success of a rip-off. Neanderthals usually deliberately don’t instantly reply to each message however wait (generally even a couple of hours) to create the phantasm that they’re busy with common on a regular basis life. Talking of time: they attempt to adapt to the Mammoth’s time zone so as to not elevate suspicion.

They usually interact in chitchat first; they might even share a faux private story. The entire function is to search for crimson flags – indicators that may inform the Neanderthal that the Mammoth is simply too suspicious or skilled. Since Neanderthals are centered on revenue, they don’t need to spend time on Mammoths who find yourself recognizing the entice.

One other nice instance is that when Neanderthals make the most of the Purchaser rip-off situation, they guarantee Mammoths that they’ve already paid for the merchandise. This, mixed with the design of the phishing electronic mail that guarantees fast cash retrieval, leads to Mammoths being much less vigilant.

Skilled Neanderthals present newcomers with full conversations to take inspiration in; one such instance is supplied in Determine 12.

Figure 12 Suggested conversation with Mammoth
Determine 12. Recommended dialog with a Mammoth (translated from Russian)

Neanderthals solely tolerate a sure stage of resistance from Mammoths – in the event that they deem the rip-off will not be more likely to succeed, they transfer to a special goal. Nonetheless, in the event that they really feel like they’ve nearly gained, they’re very persuasive. An ideal instance is their documented strategy to conditions the place they efficiently harvest the Mammoth’s delicate information, however both the financial institution blocks the transaction or there are inadequate funds. In that case, Neanderthals might go so far as asking the Mammoth to make use of a member of the family’s card and even name their financial institution and authorize the switch themselves.

Neanderthals are able to reply many surprising questions relating to the legitimacy of their requests (see Determine 13).

Figure 13 Suggested way to scam
Determine 13. Recommended option to rip-off extra perceptive Mammoths (translated from Russian)

Translation

As this operation targets Mammoths internationally, Neanderthals must create the phantasm that they communicate the Mammoth’s language effectively sufficient. It’s fairly frequent to come across Russian-speaking Neanderthals who can write in English. Apparently, we have been capable of cross-reference the Telegram nicknames of many Neanderthals with language-learning platform profiles. These accounts often acknowledged that the proprietor speaks Russian and English. Clearly, the connection could be coincidental.

For a few years Neanderthals used Google Translate. Since at the least 2021, Neanderthals moved in the direction of different translators, comparable to DeepL, as (of their opinion) it understands context higher.

Moreover utilizing translators, they’ve created many translation tables through the years, with verified translations of frequent phrases into a number of languages. These translations are mostly from Russian to European languages (see Determine 14). Neanderthals simply copy and paste these translated sentences into the chat with the Mammoth.

Figure 14 Romanian-Russian and Portuguese-Russian
Determine 14. Instance of Portuguese-Russian and Romanian-Russian translation tables

Group particular options

We must also point out that totally different teams have totally different quality-of-life enhancements to Telekopye. For instance, when producing a phishing hyperlink (a outcome may be seen in Determine 15), Neanderthals from one in every of these teams are requested a number of questions that allow them to have sure diploma of customization of every phishing web site. Probably the most fascinating is the query about handbook/computerized phishing website technology. Within the case of handbook technology, the Neanderthal should specify all info wanted to create the phishing web site. For Neanderthals posing as patrons, this takes from 10 to fifteen questions (Determine 16).

Figure 15 Example of phishing website creation process
Determine 15. Instance of computerized phishing web site creation course of by Telekopye, the place Neanderthal poses as a purchaser
Figure 16 Manual of phishing link creation process
Determine 16. Handbook phishing hyperlink creation course of

Within the case of computerized web page technology, the Neanderthal solely must specify the URL of the merchandise to “purchase” and to reply 5 questions (like what the client’s title and cellphone quantity are). Telekopye then scrapes all info from the web site and creates the phishing web site.

Anonymity and evasion

Neanderthals consider their teams are stuffed with “rats” (for instance, regulation enforcement or researchers). So, they religiously stick with the foundations, primarily no probing for info that might establish different members of the group. Breaking such guidelines might very effectively end in being banned. The golden rule is “work extra discuss much less”. As well as, they’re inspired to make use of VPNs, proxies, and TOR to remain protected. Neanderthals present newcomers with in depth guides and even interact in heated discussions over what packages or companies to make use of and why, together with browser preferences. Some Neanderthals even make the most of Orbot, a TOR variant for Android.

Cash

Neanderthals want to cover not solely their identities and site, but in addition their cash. Naturally, cryptocurrencies are the reply to that. We weren’t in a position to attract any conclusions relating to cryptocurrency choice.

Lastly, Neanderthals desire companies for which they’ll register utilizing solely a cell phone quantity. They think about this one of the best strategy, since it’s comparatively simple to purchase a SIM card whereas not disclosing their identification.

Bypassing computerized detection

On-line market scams are nothing new. Over time, the platforms offering these companies have carried out quite a few methods to counter scammers and improve their clients’ safety. The Neanderthals are conscious of this and proceed to experiment with totally different approaches to beat the platforms’ moderation insurance policies. One early and relatively silly try was to make the most of Google Varieties to phish private info from Mammoths (as seen in Determine 17). Contemplating the knowledge they focused, the aim was to acquire a method to speak by way of a special channel – electronic mail or SMS – the place strict moderation wouldn’t happen.

Figure 17 Phishing with Google Forms
Determine 17. Instance of phishing with Google Varieties

 

These days, nearly all Neanderthals attempt to switch their Mammoths to much less policed, legit chat platforms. Neanderthals select them as a result of they consider banning accounts there takes time. Moreover, sending numerous hyperlinks over chat platforms is frequent observe relatively than suspicious conduct. As a bonus, nearly everyone is accustomed to such purposes, so Neanderthals don’t have to clarify how they work.

Regardless of contemplating these platforms a lot safer, Neanderthals tread rigorously nonetheless. They keep away from sending too many messages in a brief time frame and attempt to personalize messages for various Mammoths – Telekopye aids them tremendously on this effort.

Exploring new territories: Actual property rip-off

A few of the Neanderthals’ teams point out a special type of rip-off situation – one which targets actual property renters. The rip-off works as follows. Throughout the preparation stage, Neanderthals write to a legit proprietor of an condo, pretending to have an interest and ask for numerous particulars, comparable to further footage and how much neighbors the condo has. The Neanderthals then take all this info and create their very own itemizing on one other web site, providing the condo for lease. They reduce the anticipated market value by about 20%. The remainder of the situation is an identical to Vendor rip-off situation – the Neanderthal waits for a Mammoth to indicate curiosity, and directs the Mammoth to pay a reservation charge by way of a hyperlink that, after all, truly factors to a phishing web site.

Due to ESET’s telemetry we discovered that the phishing web sites used on this rip-off situation are suspiciously much like those Telekopye creates for the Purchaser and Vendor situations. This, mixed with the rip-off being marketed by Telekopye teams, leads us to consider that there’s a connection. Nonetheless, we neither infiltrated any group specializing on this situation nor obtained a Telekopye variant designed for it.

Interview

When crawling by way of totally different manuals, teams, and extra supplies, we discovered an interview with a Telekopye administrator that was executed on the finish of 2020. This helped us get a singular perception into the thoughts of a high-ranked Neanderthal. The interviewed Telekopye administrator operated a Telekopye group specializing in instructing new Neanderthals.

The administrator is at one level requested how he sees the way forward for this line of “work”. To that, he responds that “On-line market scams will all the time be current. It’s a lot tougher [to scam] than it was once because of banning insurance policies on totally different websites. However it’s simply not doable to cease all phishing on these websites”. He additionally says that he doesn’t rip-off anymore. He simply bought uninterested in it and now works solely as administrator/tutor and that’s the reason why his group is so distinctive. “I don’t worry Mammoths. Each different Mammoth will threaten you after they understand they’ve been scammed. Apparently, everybody nowadays is a spouse or a buddy of a minister of inside affairs”, says the administrator.

When requested whether or not he is considering creating a brand new rip-off mission, he says that he doesn’t have time for that. He moderates two channels, has an energetic life-style, does a whole lot of coaching, and he has solely 4 hours a day at residence.

He additionally confesses that he’s totally conscious that this sort of a job isn’t trustworthy however finds a typical excuse for himself. “… some folks will continually pay for hyperlinks, and somebody will continually throw them. Whoever tries exhausting in life will succeed.”. On prime of that he says that if he feels sorry for Mammoth, he asks himself: “Why am I scamming them within the first place? Properly… I solely steal from the wealthy (analysis word: Mammoths that most likely have at the least €200 of their account) and if my conscience have been that fragile, I might go work as a supply man”.

Conclusion

On this second installment devoted to Telekopye, we have now centered on what we realized about Neanderthals. Due to gaining access to each their inside communication and their data base, we have now supplied not solely descriptions of various rip-off situations, however primarily a singular perception into their modus operandi and mindset.

We’ve demonstrated how the admission course of for newcomers appears to be like like and the way Telekopye aids Neanderthals of their day by day work. As well as, we have now proven that they most likely are experimenting with actual property scams as effectively.

On-line market scams are possible not going away. As we demonstrated in the primary installment, we have been capable of uncover dozens of teams working Telekopye. That stated, by having our distinctive perception into the scammers’ operation, we consider loads may be realized as a way to shield customers of such platforms from hurt.

IoCs and a MITRE ATT&CK methods desk have been supplied within the first a part of this evaluation, and are unchanged, so please check with that article for these.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com.
ESET Analysis presents personal APT intelligence reviews and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

[ad_2]

Supply hyperlink

LEAVE A REPLY

Please enter your comment!
Please enter your name here