Dutch authorities have arrested two individuals who are alleged to belong to a Dutch cybercrime gang, known as the “Fraud Family,” and to have participated in the development, sale and rental of sophisticated phishing frameworks to other malicious actors, as part of a “Fraud-as-a-Service” operation.
The two suspects, a 24-year-old software engineer and a 15-year-old boy, are said to have been the main developers and sellers of phishing frameworks used to harvest bank customer login data. The victims of the attacks were mainly located in the Netherlands and Belgium.
Roberto Martinez, senior threat intelligence analyst at Group-IB Europe, said in a report: “Phishing frameworks allow cybercriminals with minimal skills to optimize the creation and design of phishing campaigns to carry out massive malicious operations while bypassing 2FA.” He added that the gang advertises its services and interacts with other cybercriminals on the Telegram messenger.
Read also: Saudi Aramco: Hackers demand $50 million from the company
The attacks start with an email, SMS or WhatsApp, exploiting well-known local brands and containing malicious links that, when clicked, redirect to phishing websites that steal payment information. In an alternative attack scenario, the fraudsters posed as buyers on a Dutch advertising platform to contact a seller and then transferred the conversation to WhatsApp, with the aim of tricking the latter into visiting a phishing website.
Group-IB researchers pointed out the "high level of personalization" offered by the phishing websites, which not only "spoof" a legitimate Dutch marketplace, but also claim to use a well-known Dutch e-commerce payment system, only to lead the victim to a fake bank website from which customer credentials are stolen.
See also: REvil Ransomware: Gang's sites down
Specifically, the researchers reported the following: “When victims submit their banking credentials, the phishing website sends them to a web panel controlled by the scammers. This alerts the malicious actors that a new victim is online. The scammers can then request additional information that will help them gain access to bank accounts, including two-factor authentication tokens and personally identifiable information.”
According to messages posted by the group on Telegram, web panels can be rented for €200 per month (Express Panel) or for €250 if other cybercriminals choose the Reliable Panel (or Reliable Admin). At least eight Telegram channels operated by the Fraud Family have been identified to date, with the channels having 2,000 subscribers.
Proposal: DOJ: Accuses Chinese state hackers of attacks on the US
Finally, the researchers highlighted the following: “Attacks behind which the Fraud Family infrastructure is located increased in the last months of 2020. This trend continues in 2021, with the emergence of Express Panel and Reliable Panel.”
Information source: thehackernews.com
