Author: DarkOwl Content Team

April 23, 2024

Although cyber actors continue to successfully target victims globally, extorting and fraudulently obtaining large sums of money, Law enforcement are becoming increasingly adept at capturing these cybercriminals and holding them to justice.

Throughout 2023 there were a number of notable arrests and prosecutions. In this blog, DarkOwl analysts summarize what are arguably the biggest law enforcement actions of 2023 globally.

Conor Brian Fitzpatrick AKA POMPOMPURIN

In March 2023, an individual named Conor Fitzpatrick was arrested by the FBI in upstate New York. He was accused of being the administrator of popular dark web forum BreachForums.

Fitzpatrick was charged with hacking, wire fraud, and possession of child abuse imagery. He admitted to the majority of these offenses upon his arrest and was facing up to 40 years in prison. In January 2024, he was sentenced to 20 years’ supervised release. Fitzpatrick will have no access to the internet for the first year of his home confinement and must register with state sex offender registries.

Prosecutors said the following:

“By creating a platform for hackers and fraudsters to connect and conduct business, the defendant made it possible for BreachForums members to commit exponentially more crimes and more sophisticated crimes than any could have done alone.”

However, soon after Fitzpatrick’s arrest, BreachForum was back up, being run by his reported partner Baphomet. It remains to be seen how this will continue.

The Hive Ransomware Gang’s Takedown

In January 2023, the FBI announced they had successfully disrupted the Hive Ransomware group that has targeted more than 1,500 victims in over 80 countries around the world, including hospitals, school districts, financial firms, and critical infrastructure.

Since 2022, the FBI had successfully infiltrated the servers for the group and was able to provide decryption keys to their victims. This led to them, in partnership with European partners successfully seizing the infrastructure used by the group. Unlike disruptions which were attempted by Law Enforcement later in 2023 and into 2024, this appeared to disrupt the group.

In December 2023, French authorities arrested a Russian national in Paris for allegedly helping the Hive ransomware gang with laundering their victims’ ransom payments. They also seized €570,000 worth of cryptocurrency. This highlights that even after infrastructure is seized, authorities globally will continue to hunt the individuals perpetrating the crimes.

Denis Gennadievich Kulkov

Kulkov was identified as the mastermind behind the Try2Check credit card checking operation. In May 2023, the DOJ unsealed an indictment charging Kulkov with access device fraud, computer intrusion, and money laundering in connection with his operation of Try2Check, the primary service offering “card-checking” to cybercriminals in the stolen credit card trade. Kulkov reportedly earned over $18 million from the scheme.

According to the DOJ:

“The Try2Check platform catered to cybercriminals who purchased and sold stolen credit card numbers in bulk on the Internet, offering criminals the ability to quickly determine what percentage of the cards were valid and active. As such, Try2Check was a primary enabler of the trade in stolen credit card information, processing at least tens of millions of card numbers every year.”

Despite being wanted by the U.S. Secret Service, he remains in Russia, beyond U.S. authorities’ reach.

Interpol’s Arrests in Africa

In April 2023, Interpol’s Africa Cyber Surge II operation led to the arrest of multiple individuals and the seizure of assets worth millions across Africa. These operations targeted groups involved in various cyber crimes including business email compromise (BEC), romance scams, and credit card fraud. They were also able to seize, or takedown infrastructure linked to the group’s operations.

The operation led to the following:

• Cameroon: 3 suspects arrested for $850,000 online art scam.
• Nigeria: 1 individual arrested for defrauding a Gambian victim.
• Mauritius: 2 money mules arrested linked to messaging platform scams.
• Gambia: 185 malicious IPs taken down through proactive measures and partnerships.
• Cameroon: 2 darknet sites shut down by authorities.
• Kenya: 615 malware hosters taken down by authorities.

Ragnar Locker Ransomware

In October 2023, Europol announced that it had disrupted the infrastructure associated with the Ragnar Locker Ransomware group. In addition, French authorities arrested a key individual linked to the gang, who was said to be a central developer. Further individuals were also interviewed in Spain and Latvia. Two suspects associated with the ransomware crew were previously arrested from Ukraine in 2021. A year later, another member was apprehended in Canada.

This highlights that the most effective way to take down a ransomware group is not just to seize the infrastructure but also arrest the individuals behind it.

Warzone RAT Malware Operation

In February 2023, the FBI announced that it had dismantled the Warzone RAT operation, arresting two individuals associated with the malware – in Nigeria and Malta. They also indicated that they had seized multiple domains.

The Warzone RAT malware, was a Remote Access Trojan (RAT), which enabled cybercriminals to browse victims’ file systems, take screenshots, record keystrokes, steal victims’ usernames and passwords, and watch victims through their web cameras, without their knowledge or permission.

Operation ‘SpecTor’

In May 2023, the FBI spearheaded 288 arrests across multiple countries, taking down the dark web Monopoly marketplace responsible for selling drugs. It was reported to be the largest international operation against darknet trafficking of fentanyl and opioids. The operation also seized 117 firearms, 850 kilograms of drugs that include 64 kilograms of fentanyl or fentanyl-laced narcotics, and $53.4 million in cash and virtual currencies.

Lapsus$ Arrests

In August 2023, two teenagers in the United Kingdom were found guilty of conducting cyberattacks against Uber, Nvidia, Rockstar Games, and Okta, among others as part of the criminal gang Lapsus$. Arion Kurtaj, an 18 year old from the UK was sentenced to indefinite detention in a hospital.

As well as hacking major companies he was also accused of blackmailing employees and causing millions worth of damage to the companies that he targeted. He also leaked data that he had stolen from them. Another individual was also found guilty of similar charges but could not be named due to his age. This case highlighted that young individuals that are perpetrating hacking crimes results in difficulty prosecuting them because of their juvenile status.

Conclusion

Only some of the law enforcement action that took place in 2023 are described in this blog. Law enforcement are becoming more and more successful in their operations against cybercriminals both in terms of arrests and seizure of infrastructure – including on the dark web.

However, events this year (2024) have already shown that some law enforcement action is not enough to take down groups, particularly ransomware groups. Notable activity against BlackCat/ALPHV and LockBit have shown to only take the groups out for a matter of days, when no arrests take place. BlackCat are reported to have recently conducted an exit scam after a high-profile ransomware was paid, and Lockbit seem intent on revenge after their recent skirmish with the law.

It is unlikely that law enforcement will be able to eradicate cybercrime and the game whack-a-mole will continue. However, the events of 2023 show that the law enforcement bodies globally are taking action and standing up to the criminals creating dire consequences for some, which will hopefully deter future threat actors.

---

Interested in learning how DarkOwl can help with our darknet use case? Contact us!

April 18, 2024

The darknet has long been a place for criminal actors to operate with the hope of anonymity – they utilize forums to discuss nefarious and extremist activities, use marketplaces to buy and sell illicit goods, and more. In efforts to stop security researchers and law enforcement from accessing and scraping information from these sites threat actors are using increasingly sophisticated methods. In this blog, we explore some of the more complex CAPTCHAs we have seen threat actors using on darknet sites. Could you solve them?

What is a CAPTCHA? 

A CAPTCHA is a type of challenge-response test used in computing to determine whether the user is human. This is done in order to deter Bots and Spam from accessing certain portions of online content. The acronym loosely comes from the phrase; “Completely Automated Public Turing test to tell Computers and Humans Apart.”

The tool was developed by two groups working in tandem in the late 90s and was put to the task of protecting sites soon after. The first form required a user to enter a sequence of letters and numbers in a distorted image. Since then, comparable tools like Cloudflare and others have been employed for similar reasons, and CAPTCHAs have continued to develop and become more complex. Google’s reCAPTCHA and the independent hCaptcha have emerged as the most commonly used tools to ensure that the person on the other end of the browser is human.  

CAPTCHAs on the Darknet 

The black markets and community platforms on the darknet have developed a lot of different versions of these CAPTCHAs, which are also sometimes known as “Turing Tests” and have become pretty ingenious with their various methods of preventing automated traffic on their sites.  

Some of the puzzles are colorful, funny or intentionally misleading, and have definitively become a way that the various Markets and darknet operators express themselves; but not all are created equally. Some require logic, needing a human to parse out directions in the text, while others are simple. Typically, the more advanced the CAPTCHA, the more involved the other protocols of a darknet market or forum will be. Often times, they are also multi-layered, using the usual method of geometric or graphical interfaces to confuse a would-be bot attacker alongside text and other information that explains what to do. Over time, when the CAPTCHA fails to do its job, it is improved, upgraded and deployed to prevent their sites from getting crawled. 

Of course, not all sites on the darknet are in English. There are many sites which represent countries across the globe, and many of the CAPTCHAS function in the native languages of the market. An emerging trend around the darknet are CAPTCHAS intentionally implemented in different languages so that the user must manually adjust to be able to access what’s on the other side. 

Examples 

In the following section, we explore some of the more interesting CAPTCHAs frequently found on the darknet. 

The below image from the Russian market, OMG!OMG!, requires the user to input the characters shown in the box, in the traditional way that CAPTCHAs have operated. However, this site is Russian and it therefore requires you to input your response in the Cyrillic language. If the user is not a Russian native or resident, this will require them to change their keyboard settings or copy their input from a Cyrillic character tool. 

The following CAPTCHA asks the “human” to pick the odd one out. It shows various images on a confusing background. In this case, the plant would be the odd one out as all the others are animals. This appeared on the site RuTOR. 

The marketplace Kerberos requires you to complete two puzzles, one asks you to identify what is in the image from a selection of answers in a drop-down menu, to make this more difficult the pixels in the image constantly change. The other asks you to select the correct characters from a phrase, again using a drop-down menu. You have to complete this in a given amount of time otherwise the CAPTCHA will expire, and you will have to start over again.

The below CAPTCHA from the seized and now-defunct Kingdom Marketplace asks you to fill in the characters in the image, but it also highlights the characters that should appear in the URL to ensure that you are not on a scam site and that you are not being phished.

Another methodology that has been adopted by darknet operators is asking you to fill in the characters, but it will highlight which character to enter based on the box that you are filling in – meaning that the characters are not sequential as shown in the image below.

Another example is shown below where the circle will move to different characters as you enter in more. In some cases, you are able to correct your work, other times you have to reload the CAPTCHA, but these more interactive versions are fairly commonplace among the various dark web sites, many of which are tailored versions of each other. 

The below image shows an example of a CAPTCHA that requires you to solve a math problem in order to be admitted into the site. More and more sites are using sometimes quite complex math problems to make it more difficult for bots to enter the site.  

Others focus more on images. Asking you to identify which image is missing. In the below image, in order to enter the site you have to figure out which hieroglyph is missing. 

Another, from AlphaBay, will test how good you are at telling the time, but complicates the task by adding shapes to the clock face that make it very difficult to see the accurate time. You are also only given 1 minute to complete the test before it will reset.  

Conclusion 

In this blog, we have shown you the wide range of CAPTCHAs that are used across darknet sites to protect them. CAPTCHAs are used to ensure that bots are not entering a site, usually for the purposes of crawling the site or to flood the site for malicious purposes or to ensure access, such as with ticket purchasing bots. They are widely utilized on the dark web to not only protect the sites from DDOS attacks (distributed denial-of-service attack) but also to protect the users and the information on those sites from security researchers and law enforcement. This can make it particularly difficult for some users to access the darknet.  

The team at DarkOwl routinely deals with these CAPTCHAs and are able to access the dark web in order to assist those who seek to protect their information and bring an end to online criminal activity.  

---

Learn more how DarkOwl’s expertise in the darknet can help your organization. Contact Us.

April 16, 2023

At the end of March, DarkOwl participated in FIC, The International Cybersecurity Forum, in Lille, France for the second year in a row.

Now in its 16th year, FIC proudly asserts itself as the preeminent gathering in the realm of digital security and trust. Positioned as a cornerstone event in the European cybersecurity landscape, FIC distinguishes itself by fostering an inclusive environment that unites every facet of the cybersecurity ecosystem. From end consumers to service providers, law enforcement agencies to academic institutions and consultants, FIC’s scope encompasses them all.

With a dual mission, FIC addresses the operational hurdles of cybersecurity while also championing the development of a digital future aligned with European values and interests. This holistic approach ensures that attendees and sponsors gain comprehensive insights into the state of cybersecurity in Europe and have the opportunity to glean knowledge from industry luminaries.

At FIC, the over 20,000 attendees have unparalleled access to both end-users and providers of solutions and services, facilitating discussions on both tactical challenges and strategic imperatives in cybersecurity.

“Ready for AI?”

The theme of FIC 2023, was “Ready for AI?”. According to a recent report by Forbes, the artificial intelligence (AI) market is projected to reach $407 billion by 2027 and 64% of businesses expect AI to increase overall productivity.

To build relationships and trust, and share the value and essential need of darknet data for any cybersecurity posture, David Alley, CEO of DarkOwl FZE based in Dubai and Magnus Svärd, Director of Strategic Partnerships, based out of DarkOwl’s headquarters in Denver, CO, represented DarkOwl at FIC.

In addition to networking and conversations at the booth, top minds of the space have the platform to share thought leadership, innovations and the latest in the cyber security space. Speakers were present from all across Europe and the world: France, Switzerland, Luxembourg, Belgium, the United States, Netherlands, Germany, Spain, Canada, Singapore, Poland, Norway, Romania, Mexico, South Africa, China, Thailand, and more. Topics ranged from industrial infrastructure cybersecurity, quantum-resistant cryptography, identity security, international cybersecurity law, AI and counterterrorism, digital crime, social engineering, cybercrime trends, trust and safety in the cloud, and many more. Many of the presentations throughout the three days were not just thought leadership, but also practical presentations – showing the “how to.”

David and Magnus both expressed that they experienced “non-stop traffic” and kept busy on the show floor throughout the event meeting new prospects and showcasing our industry leading darknet platform, Vision UI, and meeting with several current clients and partners. With many current clients present, the DarkOwl team was able to spend time understanding how we can best optimize and elevate our current partnerships and how we can continue to provide the most value as their darknet data provider, focusing on continuing to build up our customer relationships and building trust. The DarkOwl team is confident there will be many follow ups and successful connections coming from our participation at FIC and looks forward attending The International Cybersecurity Forum in 2025.

---

DarkOwl looks forward to continuing their presence at several international events in the future. You can see what conferences we will be attending coming up and request time to chat with us here.

April 15, 2024

As the tax deadline fast approaches, it is important for us all to be aware of the risks that are posed to us by cyber criminals at this time of year. Whether it be identity theft from tax forms, targeting of tax filing providers, or fraudulent returns, there are a number of ways that the tax system can be exploited for criminal financial gain.  

As we do each year, DarkOwl analysts have reviewed the activity of cyber criminals on the dark web and dark web adjacent sites and messaging platforms to highlight some of the activities cyber criminals are participating in.  

Selling Tax Refund Methodologies 

Fraudsters on the dark web will sell step by step guides on how to conduct specific types of identity fraud. The below advertisement from Telegram is soliciting users to contact an individual to buy a tax refund methodology that allegedly bypasses the ID.ME facial recognition verification method that has recently been implemented by the IRS as a fraud prevention method.  

DarkOwl analysts have also noted several instances where the technology vendor, ID.ME, has been targeted on stealer log marketplace websites like 2Easy or Russian Market, which may allow threat actors to access accounts of users for fraudulent purposes, as stealer logs usually contain usernames, passwords and session cookies.  

Another Telegram post claims to provide buyers with a guide to obtain a Federal Tax refund claiming to offer advice on what bank account you should cash out to and what method to use. They claim that a refund will be guaranteed.  

Phishing Templates 

ID.ME is commonly targeted across the darknet. DarkOwl analysts have observed fraudsters selling phishing admin panels for sites like ID.ME, PayPal, and USPS on Telegram as well, meaning that they are able to collect the data of unsuspecting victims who believe they are adding their credentials to a legitimate site. Access to these accounts could mean that a threat actor is able to steal someone’s identity whether that be for tax fraud or other types of financial fraud.  

Selling Tax Forms 

DarkOwl analysts identified threat actors on the popular carding forum 2crd and found an actor advertising counterfeit identification documents, and also included tax return information and common tax forms which could be used to impersonate an individual. It is unclear if these documents are fraudulent in nature or had been stolen from a legitimate owner.  

Similar postings were found on another site, ProCRD, offering W2 forms with a 1040 and full info. These documents are being sold for as little as $10. These appear to be sold as part of Fullz, which is a term used by dark web actors to indicate they have the full information for an individual – this usually includes financial information and identity details to be used to conduct identity fraud or financial crime.  

A post on a Telegram channel claimed to have W2 forms, tax returns, and pay stubs for sale as well as credit card numbers, Social Security numbers and other sensitive personal information used to conduct fraud. DarkOwl analysts note this advertisement relates to an automated Telegram bot where one can purchase these illicit items. Telegram bots are an effective way to sell illicit items on Telegram because it maintains a certain level of anonymity between the seller and end user.    

Another Telegram advertisement was identified which sells similar products, but notes all of the sensitive documents being sold are from other countries like the UAE and European countries. This highlights that it is not just the US that is subject to this type of fraud. 

A third similar example from Telegram is shown below. It is important to note, as shown in all of these examples that tax forms are typically sold with other identity fraud products like fullz, credit card numbers, etc. This allows the fraudsters to be more convincing in their fraudulent activities as they have more information which makes them appear legitimate.  

The tax fraud community is considerable on Telegram, a search across DarkOwl’s dark web collection for the mention of “tax refund” on Telegram resulted in nearly 100,000 hits. However, Telegram fraudsters will typically also advertise across the darknet and deep web from sites like Royal or Russian Market to ProCRD or WWH Club – often moving to private messaging on Telegram for security.  

Telegram is a major medium/vehicle for all types of identity fraud in 2024 because the platform allows for increased security, anonymity (between sellers and end users), as well as more efficient transactions through automated chat bots, rather than processing transactions directly on a .onion site. DarkOwl analysts therefore identify a large amount of this activity on Telegram but cross over from other dark web sites highlighting that similar communities are active on both.  

Tax Filing Providers 

Many individuals will use services in order to file their taxes, as it often removes some of the stress associated with tax season, and hopefully ensures that you maximize your return. However, these organizations are also targeted at this time of year.  

A review of Stealer Logs collected by DarkOwl highlighted several instances in the last several months where credentials for these organizations were stolen. Allowing actors to access sensitive information and conduct fraudulent filings.  

There are also Telegram channels which offer buyers the chance to obtain tax refunds through TurboTax. 

Ransomware 

Ransomware attacks continue to be prevalent in 2024, with many companies subject to attack, one group PLAY, like many other groups, post their victims details on their leak site as well as details about what information they have relating to them.  

In almost all of the posts relating to their victims the group claim to have information relating to taxes, likely both the company taxes as well as employees’ details. Some of them also claim to have evidence of tax evasion.  

If/when these details are released by the ransomware group that information can be used by other threat actors to conduct other types of fraud. 

Conclusion 

Tax season is just another thing that can be used by threat actors to commit fraud against individuals and companies. However, financial fraud can be committed at any time of the year and it is important to protect your personal information by practicing good cyber hygiene, do not reuse passwords, and be vigilant to phishing and malvertising campaigns.  

---

Learn more about how DarkOwl can help your organization detect and investigate fraud by contacting us here.

April 09, 2024

A new Middle East conflict emerged on October 7, 2023, when Hamas launched an attack on Israel. It rages on to the present day, resulting in physical, digital, and hybrid events that threaten both Israel and Palestine and their borders with multiple surrounding countries. Regional stability is extremely low as actors supporting all sides of the conflict take stances and attack their self-defined opponents on the ground, at sea, and with cyber capabilities. Most recently, Hamas rejected an Israeli offer for a ceasefire on 25 March 2024, ensuring that this conflict continues for an undetermined amount of time.

In the past six months, some of the trending issues the world has witnessed include drastic upticks in maritime and ground-centered activity against Iranian-supported actors, such as the Houthis and Hezbollah. Air attacks and maritime incidents against the Houthis continue all over the Middle East region, impacting civilian vessels in various bodies of water and civilian shipping routes. Telegram remains a vital part of the conflict, with propaganda emerging from Iranian, Arabic, and Israeli Telegram channels, as well as sympathizers and opponents from all sides of the conflict taking a public stance and offering to attack on behalf of their beliefs. A sampling of these activities over the past six months since the start of the conflict is covered in this blog.

Telegram and Choosing Sides

As was previously mentioned and covered extensively in a previous blog, a trend that emerged almost immediately and continues six months later to today, was actors choosing sides in the conflict. No matter what side is supported, whether an entity is pro-Israel or pro-Hamas, supporters publicly emerge and then are targeted by opponents.

The end of 2023 witnessed a few key events, ensuring the conflict would continue into the new year of 2024. The list below is not exhaustive, and is only meant to provide high-level examples:

• Navitas Petroleum, based in Israel, was purportedly hit by BlackBasta ransomware (December, 2023)
  • However, as of the time of this writing, Navitas had no entry on the BlackBasta ransomware victim blog. It is possible this event was fabricated, or that the impacted entity struck a deal of some kind with the BlackBasta actors to have their data removed from the ransomware website. Either way, the threat of malicious actors coming after an organization because of their country or other allegiance is a continuing trend.

• Predatory Sparrow hacking group attacked 70% of Iranian gas stations (December, 2023): 

Figure 4: Predatory Sparrow group publicizes their attack of Iranian fuel stations in December, 2023; Source: DarkOwl Vision

• Iran issued a statement that the October 07 attack against Israel was in retaliation for the January 2020 assassination of IRGC commander Qassem Soleimani (December, 2023)
  • Hamas leaders publicly rejected this claim.

In 2024, some incidents included (the list below is not exhaustive, and is only meant to provide high-level examples):

• Anonymous Sudan claims to have hit Israel’s telecom company Pelephone (January, 2024):

Figure 5: Anonymous Sudan uses their Telegram channel to advertise the January 2024 attack against Israeli Telecom Pelephone; Source: DarkOwl Vision

• Lulzsec group targeted Israeli red-rocket alert system:

Figure 6: Lulzsec hacking group advertises their mid-January 2024 efforts against the Israeli rocket alert system on Telegram

• Anonymous Sudan claims to have hit Israel’s Bazan group:

Figure 7: Hacking collective Anonymous Sudan uses their Telegram channel to publicize an attack on Israeli Bazan Group in January, 2024; Source: DarkOwl Vision

• Anonymous Sudan also claimed it conducted a cyberattack targeting “critical parts” of healthcare infrastructure in Israel, and adds “more than a thousand devices are completely disconnected.”
• Terminator Security hacking group claims to have taken down Israeli Air Force servers.
• As of mid-March 2024, Raytheon was again targeted, this time by the Anonymous group due to their supplying weapons to Israel. However, Raytheon and other US defense contractors are frequently targeted by Russian groups, such as this Snatch Ransomware group observation which also came in March 2024:

Figure 8: Snatch ransomware group details attacks against US government contractor Raytheon, which is frequently targeted due to its weapons supplied to Ukraine; Source: DarkOwl Vision

Maritime Activity

Underwater mining conducted by the Houthis and other attacks against maritime vessels continued as recently as mid-March, with this physical element of conflict having cyber implications:

• Underwater sea telecom cables that transit approximately 17% of international data were damaged as maritime conflict continued in the Red Sea. Some media outlets blamed Houthi militants, while other experts state the cables were damaged by ships sinking and hitting them, as they are in shallow waters.

Maritime activity in the Red Sea also involved the United States conducting a cyberattack on an Iranian ship that had been gathering intelligence on cargo vessels in the region. This was intended to prevent the ship from sharing intelligence with Houthi members in Yemen, who have been frequently targeting civilian vessels. DarkOwl analysts have observed multiple platforms, including Discord, onion websites, and 8kun, sharing information regarding the hostile situation in the Red Sea:

Figure 9: Users discuss and share videos of Iranian activity in the Red Sea between January to March 2024; Source: DarkOwl Vision

Figure 10: Users discuss and share videos of Iranian activity in the Red Sea between January to March 2024; Source: DarkOwl Vision

Figure 11: Users discuss and share videos of Iranian activity in the Red Sea between January to March 2024; Source: DarkOwl Vision

Hybrid Incidents

Hybrid events, comprised of both digital and physical efforts to have a real-world impact, have also grown. In mid-February 2024, international media reported on an attempt to reroute an Israeli El Al airliner. The original flight path was from Bangkok, Thailand, and Tel Aviv, Israel. However, during the flight, the crew were provided with instructions that derailed them from their set route. These instructions were discarded, and the crew remained on their original flight path, once they contacted other air traffic controllers and compared flight data, and realized actors were trying to intentionally mislead them.

The incident occurred over Somali airspace, and Israeli sources revealed a certain frequency that was consistently trying to change flight paths, indicating a constant attempt to disrupt air activity. Using technology to attempt to derail a plane or any other means of transportation that carries humans who could be used as leverage in a geopolitical situation, or harmed, brings a new level of urgency towards vetting online information tied to any world event, especially a conflict.

Conclusion

As is confirmed by the events above, conflict these days has a new paradigm using technology to influence and increase physical air, ground, and maritime events, such as using a certain frequency to communicate with planes while trying to pull them from a planned, safe route. Global infrastructure such as underwater cables are either accidentally damaged by water mining or intentionally cut, in some cases, to interfere with regional internet access and connectivity. These physical threats to infrastructure and personnel are separate to the propaganda that is quickly spun and shared among all sides via messaging platforms and social media.

Malicious actors use technology to go after petroleum and water supplies, or even put services for human life, such as healthcare, at risk during geopolitical incidents. Even weapons supplies are in danger, as actors try to prevent weapons delivery or jeopardize the providers of the weapons. The technological component to conflict is here to stay, and actors will undoubtedly use any platform they feel is safe – Telegram, social media, or private messaging, or an online collection of supporters who can contribute to research, and disseminating propaganda to try and influence the public to see issues from a certain perspective.

---

Don’t miss any research from DarkOwl analysts. Subscribe to email.

April 01, 2024

Disclaimer: This blog seeks to illuminate the practices used by threat actors that involve the nefarious application of artificial intelligence (AI) technologies. While the instances discussed herein do not imply that chatbots and similar tools are intrinsically hazardous, they serve to demonstrate the potential for their misuse by cybercriminals. None of the examples generated should be used.  

Introduction

Cyberattacks are becoming more and more commonplace, with no one immune from attacks, whether it be corporations suffering from ransomware attacks or individuals falling victim to romance scams. But as people become more educated about the risks of cyberattacks and scams, cyber attackers must change their methods to ensure success.  

Last April Fool’s Day, we looked how cyber actors trick us with phishing emails. This April Fool’s Day, we explore some of the ways that cyber actors could use new technology such as AI to fool their victims into allowing them access to their systems or finances.  

Phishing 

A phishing email is a deceptive email designed to trick the recipient into believing it’s from a trustworthy source, with the aim of stealing sensitive information, such as login credentials, financial details, or personal data. These emails often mimic the appearance and tone of official communications from well-known companies, banks, or government agencies. The emails will often request personal information, include suspicious links or attachments and generic information.  

Most people these days are aware that they should not click on links in emails from people they don’t recognize and emails that appear to have spelling or grammar mistakes in them. But phishing emails are becoming more sophisticated, and AI can be used to generate emails that are more believable.  

We asked an AI platform to write us an email:  

This is the response we got: 

This took seconds to generate and could be used to fool people. 

Smishing

Smishing is a type of phishing scam conducted through SMS (Short Message Service) text messages. It involves sending deceptive text messages that aim to trick recipients into revealing personal information, clicking on malicious links, or performing actions that compromise their security. These messages often impersonate legitimate companies, organizations, or even acquaintances, creating a sense of urgency or fear to prompt immediate action from the victim. 

Smishing campaigns are often used by threat actors to entice people as part of a romance scam or pretending to be customer support asking a user to share a password or click on a push notification. They can take many forms pretending to reward you with a prize or tell you that you missed a package delivery. They are becoming increasingly sophisticated and take many forms. Below we show a sample of these. 

Social Engineering 

Social engineering is a manipulation technique that exploits people to gain unauthorized access to information, systems, or buildings. Unlike traditional hacking, which often relies on technical vulnerabilities, social engineering targets the human element of security systems. The goal is to trick or deceive people into doing what the attacker wants them to do, whether that be access to systems or obtaining financial reward.  

Social engineering can take many forms, from generating a phishing email based on specific information found on social media to make it more targeted to the victim to creating fake social media profiles to target individuals whether on a dating app or networking app to entice people to communicate with them.  

We had an AI tool generate us a dating profile: 

But we also need a picture to go with the profile to make it more believable, so we asked AI to generate us one of those as well.  

These prompts could be tailored in order to create a profile that is more likely to appeal to the desired victim. Research can be conducted, and all of that information can be inputted into an AI generator to create the perfect profile for the job.  

Vishing 

Vishing, short for “voice phishing,” is a form of social engineering attack where fraudsters use telephone services to scam individuals into disclosing sensitive personal information, such as bank account numbers, credit card details, personal identification numbers (PINs), and passwords. Unlike traditional phishing attacks, which typically occur through email or malicious websites, vishing specifically involves voice or telephone communication. 

While threat actors previously had to conduct these calls themselves it is now possible to generate voices using AI. While it is difficult to use this for an actual conversation it can be used to create prompts of voicemails. Using AI, it is also possible to emulate someone’s voice meaning that you could receive a voicemail from someone who sounds just like your boss asking you to send funds or resent a password that sounds really believable. There have also been reported instances of people appearing on video conferencing calls where their image and voice have been manipulated to provide the message the threat actor wants to give.  

Using AI, we are able create a voice message. You can select the type of voice you want to hear, the tone of the message, how to pronounce certain words and where to pause in the conversation. Leading to a believable message.  

Conclusions 

It is worth noting that most AI providers have tried to implement security features and guardrails to prevent threat actors from utilizing their platforms for nefarious purposes. However, systems can be jailbroken and threat actors are also able to use the technology to create their own LLM (large language model) to generate the kinds of responses that they want. There are already dark web AI tools that have been developed such as WormGPT and FraudGPT. AI does not create new scams or ways of working. As it does with all of us, it simply speeds up and improves the activities the prompter is seeking to conduct. In fact, some of the descriptions in this blog were generated using AI highlighting legitimate uses.  

There are lots of ways that cyber criminals can trick us into providing information we don’t want to, falling for scams, providing funds or access to profiles. However, this is nothing new and we should continue to be vigilant in the same way we always have been, while understanding that as technology develops, cyber actors are also developing the tools and techniques they use to try and fool us. 

---

Curious how DarkOwl can help with your use case? Contact Us!