Attackers Use Classic Techniques – Typosquatting, Phishing, Backdoored Malware, Fake Marketplaces, and Much More – to Scam Each Other; Sub-Economy in Just 3 Cybercriminal Forums Generated More Than $2.5 Million in 12 Months

OXFORD, U.K. — 12月 7, 2022 —

Sophos, a global leader in innovating and delivering cybersecurity as a service, today announced in the first of a four-part series, “The Scammers Who Scam Scammers on Cybercrime Forums,” that cybercriminals are scamming each other out of millions of dollars and use arbitration to settle disputes about the scams. The report also reveals how attackers use classic techniques—some decades old, such as typosquatting, phishing, backdoored malware, and fake marketplaces—to carry out their scams against each other.

For this report, Sophos X-Ops experts investigated Exploit and XSS, two Russian-language cybercrime forums that provide Access-as-a-Service (AaaS) listings, and BreachForums, an English-language cybercrime forum and marketplace specializing in data leaks. All three sites have dedicated arbitration rooms. Despite this resolution process provoking occasional mayhem among the “plaintiffs and defendants,” with some accused criminals either going dark and not showing up, or calling the complainants themselves “rippers,” the practice of scammers scamming scammers is lucrative. During a 12-month period, Sophos examined approximately 600 scams that resulted in threat actors losing more than $2.5 million to each other, just on these three forums—with claims ranging from $2 to $160,000.

“While investigating cybercriminal scams, we stumbled upon an entire sub-economy that includes not just lower-tier criminals, but some of the most prominent ransomware groups. And these scams aren’t always just financially motivated. Personal beefs and rivalries were common. We also found incidents where scammers would scam the scammers who scammed them. In one case, we found a trolling contest set up to get revenge on a scammer trying to trick users into paying $250 to join a fake underground forum. The ‘winner’ of the contest received $100,” said Matt Wixey, senior threat researcher, Sophos.

Sophos also discovered that the arguments and arbitration process left behind a wealth of untapped intelligence that security professionals and law enforcement could leverage to better understand and defend against cybercriminal behaviors.

“Because criminals often need to offer up a lot of evidence when reporting the scams that they themselves have fallen victim to, they provide a wealth of tactical and strategic information about their operations—something which has been an untapped resource until now. These arbitration reports also give us an inside look at attackers’ priorities, their rivalries and alliances, and, ironically, how they’re susceptible to the same types of deception used against their victims,” said Wixey.

Read part one of the four-part series on “The Scammers who Scam Scammers on Cybercrime Forums” on Sophos.com.

ソフォスについて

ソフォスは、サイバーセキュリティ業界のリーダー企業として、AI を駆使したプラットフォームや精鋭スタッフによるサービスを世界中の 600,000社以上のお客様にご利用いただいています。セキュリティの成熟度にかかわらず、あらゆるお客様のご要望にお応えし、サイバー攻撃を撃退すべくお客様とともに成長を続けています。機械学習や、自動化、リアルタイムの脅威インテリジェンスに、Sophos X-Ops の最前線スタッフから得た専門知識を組み合わせて、高度な脅威監視、検出、対応を 24時間 365日体制で行っています。
ソフォスは、業界最先端の MDR (managed detection and response) を提供しているのに加えて、エンドポイントをはじめ、ネットワーク、メール、クラウドセキュリティ、XDR (extended detection and response)、ITDR (identity threat detection and response)、次世代の SIEM まで、サイバーセキュリティテクノロジーのあらゆるラインナップを取り揃えています。さらに、専門家によるアドバイザリーサービスも提供しており、組織はこれらを組み合わせて利用することで、リスクをあらかじめ減らし、迅速な対応をとれるようになるだけでなく、進化し続ける脅威の一歩先をいくために必要な可視性および拡張性を確保することが可能となります。
ソフォスは、グローバルに広がるパートナーエコシステムを通じて市場展開しており、お客様は、MSP (Managed Service Provider)、MSSP (Managed Security Service Provider) や、リセラー、ディストリビューターのほか、マーケットプレイスにおける統合、ソフォスのサイバーリスクパートナーまで、信頼できる関係性を自由にお選びいただけます。  ソフォス本社は英国のオックスフォードにあります。詳細については www.sophos.com をご覧ください。