Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label U.S. targets. Show all posts
young male fraudsters
Bitcoin Scams Cryptocurrency Fraud Cyber Fraud digital financial crime EFCC report Nigeria social media platforms study U.S. targets University of Surrey young male fraudsters

Emerging Wave of Digital Criminals Targets U.S. Financial Systems

 

A recent study by the University of Surrey, in partnership with Nigeria’s Economic and Financial Crimes Commission (EFCC), reveals that cryptocurrency fraud in Nigeria is overwhelmingly carried out by young men, with males accounting for all convicted offenders and nearly two-thirds of them under 30. Over half (55%) of these cases target victims in the United States, illustrating a troubling cross-border crime trend.

The analysis highlights a growing wave of young, tech-savvy criminals leveraging digital currencies to execute sophisticated fraud schemes, making enforcement a major challenge. 

Dr. Suleman Lazarus, co-author and cybercrime specialist at the University of Surrey, pointed out the urgent need for global collaboration to address the issue, noting, “Our findings expose a surge in cryptocurrency fraud, led by a generation of male offenders using online platforms and digital currencies to conduct high-stakes crimes with global reach.”

The study involved a comprehensive review of case files, which revealed that platforms such as Facebook (27%), Gmail (22%), and Instagram (14%) are frequently used to contact and deceive victims. Notably, Bitcoin is the cryptocurrency of choice for nearly half (46%) of these schemes, complicating efforts to trace and recover stolen funds due to its inherent anonymity.

Financial gains from these scams vary widely, from as little as $1,000 to as high as $475,000 in cash, with some fraudsters accumulating up to 1,200 Bitcoin—worth an estimated $81.96 million. Contrary to the assumption that technical sophistication requires advanced education, only about 25% of the convicted fraudsters held a degree.

Dr. Lazarus emphasizes that the popularity of digital currencies calls for heightened awareness among law enforcement, policymakers, and the public to combat this evolving financial threat.
Read more »
U.S. targets
Agent Raccoon Backdoor Hacking malware Online Security Threat actor U.S. targets

Hackers Use This New Malware to Backdoor Targets in Middle East, Africa and U.S

 

Various entities in the Middle East, Africa, and the United States have fallen victim to an unidentified threat actor orchestrating a campaign involving the dissemination of a recently discovered backdoor named Agent Racoon. According to Chema Garcia, a researcher at Palo Alto Networks Unit 42, the malware is crafted using the .NET framework and exploits the domain name service (DNS) protocol to establish a covert communication channel, facilitating diverse backdoor functionalities.

The targeted organizations hail from a range of sectors, including education, real estate, retail, non-profit, telecommunications, and government. Despite the lack of attribution to a specific threat actor, the campaign is suspected to be state-sponsored due to discernible victimology patterns and the utilization of sophisticated detection and defense evasion techniques. Palo Alto Networks is monitoring this threat cluster under the label CL-STA-0002. The exact method of infiltration and the timeline of the attacks remain unclear at this point.

The adversary employs additional tools alongside Agent Racoon, such as a customized version of Mimikatz named Mimilite and a novel utility known as Ntospy. The latter utilizes a custom DLL module implementing a network provider to pilfer credentials for a remote server. Notably, while Ntospy is employed across the affected organizations, Mimilite and Agent Racoon are specifically found in the environments of non-profit and government-related organizations.

Agent Racoon, executed through scheduled tasks, enables the execution of commands, uploading and downloading of files, all while camouflaging itself as Google Update and Microsoft OneDrive Updater binaries. The command-and-control (C2) infrastructure linked to the implant dates back to at least August 2020, with the earliest sample of Agent Racoon uploaded to VirusTotal in July 2022.

Unit 42's investigation revealed instances of successful data exfiltration from Microsoft Exchange Server environments, resulting in the theft of emails matching various search criteria. The threat actor has also been observed harvesting victims' Roaming Profile. Despite these findings, the tool set associated with this campaign has not been definitively linked to a specific threat actor and appears to extend beyond a single cluster or campaign, according to Garcia.
Read more »
Subscribe to: Posts (Atom)