OXFORD, U.K. — 12月 21, 2022 —

Sophos, a global leader in innovating and delivering cybersecurity as a service, today revealed details of how it tracked down the likely culprit behind more than 20 fake criminal marketplaces designed to con cyberscammers in part three of Sophos’ series, “The Scammers Who Scam Scammers on Cybercrime Forums.” After stumbling upon a surface website mimicking the real criminal underground site Genesis, Sophos researchers further uncovered the 20 fake marketplaces dating back to August 2021. All of the fake sites appeared to be run by a scammer who uses the handle “waltcranston,” a likely riff on the television show “Breaking Bad.”

“While investigating this huge sub-economy of scammers scamming other scammers, we examined about 600 scams of varying types. Out of all the scams investigated, this operation stood out for its sheer scope and intricacy. The scammer advertises the fake marketplaces on Reddit and replicates not just Genesis, which was the first scam site we ran across, but numerous other prominent or defunct marketplaces, such as Benumb, UniCC, and PoisOn. While at a technical level these scam sites are not sophisticated, the scam operation has been highly successful. In fact, seven of these fake sites are still active, and, to date, the cryptocurrency wallets associated with the scams have received at least $132,000,” said Matt Wixey, senior threat researcher, Sophos.

All 20 of the fake sites followed a similar scheme. Criminals were offered a chance to activate an account on the fraudulent version of a dark web marketplace with $100. The criminals expected their $100 would be deposited in either Bitcoin or Monero, and they would receive activation credentials. However, as part of the scam, once the criminals paid, their account would never activate.

Screenshot: The deposit demand from the fake Genesis site


Sophos X-Ops: The deposit demand from the fake Genesis site

 

One common denominator among the 20 fake sites was a link to a website called darknet[.]markets—a site that lists dark web criminal marketplaces for visitors interested in drugs sales, carding, and cryptocurrency exchanges. This site ultimately led Sophos to a criminal forum called Café Dread—and a user going by the name of waltcranston.

Screenshot: A post on Dread Cafe

Sophos X-Ops: A post on Dread Café by waltcranston (now deleted)


“We started searching Dread for any mentions of the marketplaces mentioned on the darknet[.]markets, and we found multiple posts by the handle waltcranston talking about dark web marketplaces, as well as discussing how to scam people and recommending other users set up phishing sites. His own website, which sells meth, also shared some similarities with the fake marketplaces. We even found posts by Dread users who fell for the scam websites, and accusations by a Dread user that waltcranston was the culprit behind the scheme. While we can’t be 100% certain that those behind the handle waltcranston is indeed the culprit, there is strong circumstantial evidence. The entire operation and our investigation is an example of how much rich intelligence there is about cybercriminals hidden in these scams against other scammers, which the security community can leverage to help develop stronger defenses,” said Wixey.

Read more about these 20 fake marketplaces in Scammers Scamming Scammers Part 3 on Sophos.com.

ソフォスについて

ソフォスは、サイバー攻撃に打ち勝つための高度なセキュリティソリューションのグローバルリーダーです。2025年2月にセキュアワークスを買収し、MDRを中心にAIに最適化されたサービス、テクノロジー、製品を提供するサイバーセキュリティ業界の先駆者として、新たな展開を迎えました。ソフォスは現在、28,000以上の組織をサポートする世界最大のMDR(Managed Detection and Response)プロバイダーとなりました。ソフォスのポートフォリオには、先進的エンドポイントやネットワーク、メール、クラウドセキュリティが含まれ、Sophos Centralプラットフォームを通じて統合的防御を提供しています。セキュアワークスは、Taegis、ID脅威検出と対応(ITDR)、次世代 SIEM、リスク管理、包括的なアドバイザリーサービスを提供しています。ソフォスは、これらすべてのソリューションを、世界中のリセラーパートナー、マネージドサービスプロバイダー(MSP)、マネージドセキュリティサービスプロバイダー(MSSP)を通じて提供することで、フィッシング、ランサムウェア、データ盗難、などの日常的なサイバー犯罪や、国家主導型サイバー攻撃から世界60万以上の組織を守っています。このソリューションは、Sophos X-Opsによる脅威インテリジェスと、新たに統合されたCounter Threat Unit (CTU) のデータによって強化されます。ソフォスは英国オックスフォードに本社を置いています。詳細は www.sophos.com をご覧ください。