November 8, 2024

The rising reputation of on-line marketplaces has attracted fraudsters preying on unsuspecting patrons and sellers, trying to rating cost card info relatively than to strike a discount. ESET researchers have discovered that one such organized scammer community – which makes use of Telekopye, a toolkit found by ESET Analysis in 2023 – has expanded its operations to focus on customers of common lodging reserving platforms.

Final 12 months, we revealed a two-part blogpost collection on Telekopye, a Telegram-based toolkit cybercriminals use to rip-off folks on on-line marketplaces. The primary half targeted on Telekopye’s key options, whereas the second half examined the interior workings of the affiliated rip-off teams. On this blogpost, we observe up on what has modified in Telekopye operations since our final publication, primarily based on our continued monitoring. We glance into how these scammer teams have branched out to focusing on Reserving.com and Airbnb, in addition to their varied different efforts to optimize their operations and maximize monetary achieve. Final however not least, we offer steerage on find out how to keep protected against these scams.

We offered our up to date findings on Telekopye on the Virus Bulletin conference on October 2nd, 2024, and in our white paper, which you’ll learn in full here. The paper was additionally revealed on the Virus Bulletin website.

Key factors of this blogpost:

  • ESET Analysis shares up to date findings on Telekopye, a rip-off toolkit designed to assist cybercriminals defraud folks on on-line marketplaces.
  • Whereas our earlier analysis explored the technical and organizational background of Telekopye scams, our newest analysis describes the scammers’ varied efforts to maximise their monetary beneficial properties – increasing their sufferer pool, profiting from seasonal alternatives, and enhancing their instruments and operations.
  • Most notably, Telekopye teams have expanded their focusing on to common lodging reserving platforms, resembling Reserving.com and Airbnb.
  • This new rip-off state of affairs comes with a focusing on twist, using compromised accounts of official motels and lodging suppliers.
  • These scams had been particularly prevalent in the summertime vacation season within the focused areas, surpassing Telekopye market scams, in response to ESET telemetry.

Telekopye overview

Telekopye is a toolkit that operates as a Telegram bot, primarily serving as a Swiss Military knife for turning on-line market scams into an organized illicit enterprise. It’s utilized by dozens of rip-off teams, with as much as 1000’s of members, to steal thousands and thousands from Mammoths, as they name the focused patrons and sellers. Neanderthals, as we name the scammers, require little to no technical data – Telekopye takes care of the whole lot in a matter of seconds.

Found by ESET Analysis in 2023, Telekopye has been in use since not less than 2016, with victims everywhere in the world. A number of leads level to Russia because the nation of origin of the bot’s creator(s) and in addition the scammers utilizing it. Telekopye is designed to focus on a big number of on-line companies in Europe and North America, resembling OLX, Vinted, eBay, Wallapop, and others. On the time of writing, now we have counted roughly 90 completely different companies being focused by the scams.

Neanderthals – members of any Telegram group using Telekopye – achieve entry to the bot’s UI, which allows easy era of phishing emails, SMS messages, internet pages, and different options.

Telekopye teams have a business-like operation, with a transparent hierarchy, outlined roles, inside practices – together with admission and mentoring processes for newcomers – fastened working hours, and fee payouts for Telekopye directors. The Staff performing the scams should flip over any delicate info stolen, and don’t truly steal any cash – that’s managed by different roles within the group. Every group retains a clear chat of all transactions, seen to all members.

Neanderthals make the most of two essential situations for focusing on on-line marketplaces – one the place they pose as sellers and one other, far more widespread, the place they pose as patrons. Each situations finish with the sufferer/Mammoth coming into cost card info or on-line banking credentials right into a phishing internet web page mimicking a cost gateway.

Just lately, Telekopye teams have expanded their focusing on by including help for scamming customers of common on-line platforms for reserving lodging, which we cowl within the following part.

Branching out to lodging reserving platforms

In 2024, Telekopye teams have expanded their scamming playbook with schemes focusing on customers of common on-line platforms for lodge and house reservations, resembling Reserving.com and Airbnb. They’ve additionally elevated the sophistication of their sufferer choice and focusing on.

Concentrating on with a twist

On this new rip-off state of affairs, Neanderthals contact a focused person of considered one of these platforms, claiming that there’s a difficulty with the person’s reserving cost. The message incorporates a hyperlink to a well-crafted, legitimate-looking internet web page mimicking the abused platform.

The web page incorporates prefilled details about a reserving, such because the check-in and checkout dates, value, and site. This comes with a troubling twist: the information offered on the fraudulent pages matches actual bookings made by the focused customers.

The Neanderthals obtain this by using compromised accounts of official motels and lodging suppliers on the platforms, which they probably entry by way of stolen credentials bought on cybercriminal boards. Utilizing their entry to those accounts, scammers single out customers who not too long ago booked a keep and haven’t paid but – or paid very not too long ago – and call them by way of in-platform chat. Relying on the platform and the Mammoth’s settings, this results in the Mammoth receiving an e-mail or SMS from the reserving platform.

This makes the rip-off a lot tougher to identify, as the data offered is personally related to the victims, arrives by way of the anticipated communication channel, and the linked, pretend web sites look as anticipated. The one seen signal of one thing being amiss are the web sites’ URLs, which don’t match these of the impersonated, official web sites. Neanderthals can also use their very own e-mail addresses for the preliminary communication (relatively than the compromised accounts), by which case the emails is likely to be extra simply acknowledged as malicious.

As soon as the goal fills out the shape on the phishing web page (Determine 1), they’re delivered to the ultimate step of the “reserving” – a type requesting cost card info (Determine 2). As within the market scams, card particulars entered into the shape are harvested by the Neanderthals and used to steal cash from the Mammoth’s card.

Determine 1. Instance of a pretend Reserving.com type created by Telekopye
Determine 2. Instance of a pretend Reserving.com cost type created by Telekopye

In accordance with ESET telemetry, this sort of rip-off began gaining traction in 2024. As seen in Determine 3, the accommodation-themed scams noticed a pointy uptick in July, surpassing the unique Telekopye market scams for the primary time, with greater than double the detections throughout that month. In August and September, the detection ranges for the 2 classes evened out.

As this enhance coincides with the summer season vacation season within the focused areas – prime time for profiting from folks reserving stays – it stays to be seen whether or not this pattern will proceed. Wanting on the total 2024 knowledge, we will see that these newer scams have amassed roughly half of the detection numbers of {the marketplace} variants. That is noteworthy contemplating that the newer scams give attention to two platforms solely, in comparison with the wide range of on-line marketplaces focused by Telekopye.

Determine 3. Varieties of on-line companies focused by Telekopye in 2024, seven-day shifting common detection pattern

Superior Telekopye options

Moreover diversifying their goal portfolio, Neanderthals have additionally improved their instruments and operations to extend their monetary returns.

All through our monitoring of Telekopye, we’ve noticed that completely different Telegram teams implement their very own superior options into the toolkit, aimed toward rushing up the rip-off course of, enhancing communication with targets, defending phishing web sites towards disruption by opponents, and different objectives.

Automated phishing web page era

To hurry up the method of making rip-off supplies for posing as patrons on marketplaces, Neanderthals applied internet scrapers for common focused platforms. With these, solely the URL to the product is required, as an alternative of getting to manually fill out a questionnaire concerning the focused Mammoth and product in query. Telekopye parses the online web page and extracts all crucial info routinely, offering a major speedup for the scammers.

Interactive chatbot with on-the-fly translation

Neanderthals preserve a big assortment of predefined solutions to questions generally requested by Mammoths. These are translated into varied languages and stored as a part of inside documentation, with the translations perfected through the years.

Neanderthals usually use these predefined phrases to attempt to direct the Mammoth to the phishing web site, which comes with a chatbot within the decrease proper nook. Any message the Mammoth enters into the chat is forwarded to the Neanderthal’s Telegram chat, the place it’s routinely translated. Automated translation of Neanderthals’ messages shouldn’t be supported – Neanderthals translate their messages manually, often utilizing DeepL. Determine 3 reveals how such an interplay appears to be like from the Neanderthal’s and Mammoth’s factors of view.

Determine 4. Chatbot instance from Neanderthal’s (left) and Mammoth’s (proper) factors of view. Neanderthal messages had been machine translated from Russian to English.

Anti-DDoS measures

The overwhelming majority of the phishing web sites are serviced by Cloudflare, counting on that service’s added safety, primarily towards crawlers and automated evaluation. Curiously, among the Telekopye phishing web sites additionally include DDoS safety included. In accordance with the Neanderthals’ data base, which we obtained by infiltrating their ranks, this characteristic goals to guard towards assaults by rival teams. These are generally launched as a way to disrupt a competitor’s operations for a brief interval.

Legislation enforcement operations

In late 2023, after ESET Analysis had revealed its two-part collection on Telekopye, Czech and Ukrainian police arrested tens of cybercriminals using Telekopye, together with the important thing gamers, in two joint operations. Each operations had been aimed towards an unspecified variety of Telekopye teams, which had gathered not less than €5 million (roughly US$5.5 million) since 2021, primarily based on police estimates.

Moreover the plain success in disrupting such legal actions, the arrests offered new insights into the teams’ workings, most notably recruitment and employment practices. The teams in query had been managed, from devoted workspaces, by middle-aged males from Japanese Europe and West and Central Asia. They recruited folks in troublesome life conditions, by means of job portal postings promising “straightforward cash”, in addition to by focusing on technically expert international college students at universities.

Some perpetrators confessed that additionally they participated in one other rip-off group, much like the Telekopye ones, that utilized name facilities. The police discovered that the recruits in that operation had been usually stripped of their passports and private IDs to make quitting very troublesome. Additional, the managers generally went as far as to threaten the employees and their members of the family. This chilling improvement places these operations into a totally completely different mild.

Suggestions

One of the best ways to remain protected towards scams pushed by Telekopye is being conscious of Neanderthals’ techniques and exercising warning on the affected platforms. Moreover figuring out what crimson flags to concentrate to, we strongly advocate utilizing a good antimalware resolution in your machine to step in should you do find yourself being lured to a phishing web site.

On-line market scams

  • At all times confirm the individual you might be speaking with, primarily their historical past on the platform, age of their account, score, and site – a location too distant, a recent account with no historical past, or a foul score is likely to be indicators of a scammer.
  • With the enhancements in machine translation, messages from a scammer may not increase any crimson flags when it comes to grammar. Fairly than specializing in the language, give attention to the dialog itself – overly keen or assertive communication ought to increase some issues.
  • Hold the communication on the platform, even when the individual you’re speaking to suggests in any other case. Their unwillingness to remain on the platform ought to be a significant crimson flag.
  • If you’re a purchaser, use safe interfaces throughout the platform all through the entire shopping for course of, at any time when out there. In any other case, insist on in-person trade of products and cash, or organize in your selection of dependable supply companies with the choice to pay on supply.
  • If you’re a vendor, use safe interfaces throughout the platform all through the entire promoting course of, at any time when out there. In any other case, handle supply choices your self and don’t conform to these provided by the client.
  • In case you get to a degree the place you do go to a hyperlink despatched by the individual you might be speaking to, be sure you fastidiously examine the URL, content material, and certificates properties of the web site earlier than partaking with it.

Lodging reserving scams

  • Earlier than filling out any varieties associated to your reserving, all the time be sure to haven’t left the official web site or app of the platform in query. Being directed to an exterior URL to proceed together with your reserving and cost is an indicator of a doable rip-off.
  • As a result of this rip-off makes use of compromised accounts of lodging suppliers, contacting the suppliers instantly shouldn’t be a dependable manner of verifying the legitimacy of cost requests. When unsure, contact the official buyer help of the platform (Booking.com, Airbnb) or report a safety challenge (Booking.com, Airbnb).
  • To guard your account from compromise, whether or not you’re reserving lodging or renting one out, use a powerful password and allow two-factor authentication wherever out there.

Conclusion

Our analysis into Telekopye actions has given us distinctive insights into these scams: we had been capable of perceive the technical means behind the scope of the operations, the enterprise facet of Telekopye teams, and even find out about Neanderthals themselves.

We have now described the teams’ varied efforts to maximise their monetary beneficial properties, together with increasing their sufferer pool, profiting from seasonal alternatives, and enhancing their instruments and operations. Most notably, now we have detailed the Neanderthals’ latest method of focusing on lodging reserving platforms, which additionally comes with extra refined focusing on.

It’s price noting that now we have communicated with a number of platforms focused by Telekopye all through our analysis; they’re totally conscious of those scams and confirmed they’ve employed a number of techniques to fight them. Nonetheless, warning continues to be suggested for customers because of the variety of the scams and their steady evolution.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at [email protected]
ESET Analysis presents non-public APT intelligence experiences and knowledge feeds. For any inquiries about this service, go to the ESET Threat Intelligence web page.

IoCs

Recordsdata

SHA-1  Filename  Detection  Description 
E815A879F7F30FB492D4043F0F8C67584B869F32  rip-off.php  PHP/HackTool.Telekopye.B  Telekopye bot. 
378699D285325E905375AF33FDEB3276D479A0E2  rip-off.php  PHP/HackTool.Telekopye.B  Telekopye bot. 
242CE4AF01E24DB054077BCE3C86494D0284B781  123.php  PHP/HackTool.Telekopye.A  Telekopye bot. 
9D1EE6043A8B6D81C328C3B84C94D7DCB8611262  mell.php  PHP/HackTool.Telekopye.B  Telekopye bot. 
B0189F20983A891D0B9BEA2F77B64CC5A15E364B  neddoss.php  PHP/HackTool.Telekopye.A  Telekopye bot. 
E39A30AD22C327BBBD2B02D73B1BC8CDD3E999EA  nscode.php  PHP/HackTool.Telekopye.A  Telekopye bot. 
285E0573EF667C6FB7AEB1608BA1AF9E2C86B452  tinkoff.php  PHP/HackTool.Telekopye.A  Telekopye bot. 

Community

IP Area Internet hosting supplier First seen Particulars
N/A  3-dsecurepay[.]com  Cloudflare, Inc. 2024⁠-⁠05⁠-⁠30  Telekopye phishing area. 
N/A  approveine[.]com  Cloudflare, Inc. 2024⁠-⁠06⁠-⁠28  Telekopye phishing area. 
N/A  audittravelerbookdetails[.]com  Cloudflare, Inc. 2024-06-01  Telekopye phishing area. 
N/A  btsdostavka-uz[.]ru  TIMEWEB-RU  2024-01-02  Telekopye phishing area. 
N/A  burdchoureserdoc[.]com  Cloudflare, Inc. 2024-05-31  Telekopye phishing area. 
N/A  check-629807-id[.]high  Cloudflare, Inc. 2024-05-30  Telekopye phishing area. 
N/A  contact-click2399[.]com  Cloudflare, Inc. 2024-05-26  Telekopye phishing area. 
N/A  contact-click7773[.]com  Cloudflare, Inc. 2024-05-30  Telekopye phishing area. 
N/A  get3ds-safe[.]data  Cloudflare, Inc. 2024-05-31  Telekopye phishing area. 
N/A  hostelguest[.]com  Cloudflare, Inc. 2024-05-30  Telekopye phishing area. 
N/A  order-9362[.]click on  Cloudflare, Inc. 2024-05-29  Telekopye phishing area. 
N/A  shiptakes[.]data  Cloudflare, Inc. 2024-05-29  Telekopye phishing area. 
N/A  quickroombook[.]com  Cloudflare, Inc. 2024⁠-⁠06⁠-⁠02  Telekopye phishing area. 
N/A  validation-confi[.]data  Cloudflare, Inc. 2024-05-29  Telekopye phishing area. 

MITRE ATT&CK strategies

This desk was constructed utilizing version 15 of the MITRE ATT&CK framework.

Tactic  ID  Title  Description 
Reconnaissance  T1589  Collect Sufferer Id Info  Telekopye is used to assemble cost card particulars, cellphone numbers, e-mail addresses, and many others. by way of phishing internet pages. 
Useful resource Growth  T1583.001  Purchase Infrastructure: Domains  Telekopye operators register their very own domains. 
T1585  Set up Accounts  Telekopye operators set up accounts at on-line marketplaces. 
T1585.002  Set up Accounts: E-mail Accounts  Telekopye operators arrange e-mail addresses related to the domains they register. 
T1586.002  Compromise Accounts: E-mail Accounts  Telekopye operators use compromised e-mail accounts to extend their stealthiness. 
T1587.001  Develop Capabilities: Malware  Telekopye is customized malware. 
T1588.002  Receive Capabilities: Software  Telekopye operators use further bots to launder cash, scrape market analysis, and implement DDoS safety. 
Preliminary Entry  T1566.002  Phishing: Spearphishing Hyperlink  Telekopye sends e-mail or SMS messages that comprise hyperlinks to phishing web sites. 
Assortment  T1056.003  Enter Seize: Internet Portal Seize  Internet pages created by Telekopye seize delicate info and report it to the operators.