0% found this document useful (0 votes)
87 views

I4C Daily Digest - 07.03.2024

A cybercrime ring that conducted online fraud was dismantled with the arrest of four individuals in Chandigarh, India. The scam involved tricking victims into installing fraudulent loan apps that then stole victims' bank details and extorted them by threatening to share manipulated nude photos. An investigation revealed the syndicate was based in Dubai and operated through shell companies and bank accounts in India. The arrests came after a complaint from a victim who lost Rs. 43.8 lakh to the scammers through their manipulation of multiple fraudulent loan apps.

Uploaded by

rohit.shivani
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
87 views

I4C Daily Digest - 07.03.2024

A cybercrime ring that conducted online fraud was dismantled with the arrest of four individuals in Chandigarh, India. The scam involved tricking victims into installing fraudulent loan apps that then stole victims' bank details and extorted them by threatening to share manipulated nude photos. An investigation revealed the syndicate was based in Dubai and operated through shell companies and bank accounts in India. The arrests came after a complaint from a victim who lost Rs. 43.8 lakh to the scammers through their manipulation of multiple fraudulent loan apps.

Uploaded by

rohit.shivani
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 18

7th March 2024

National

S. No. News Source

How a 21-year-old student in Rajasthan trained an army of The Economic


1.
500 youths in online fraud, fake stock returns Times

International loan app scam unravels with arrest of four in


2. Hindustan Times
Chandigarh

A cyber fraud ring that duped public through customer care


3. numbers listed on Google has been dismantled by the Cyber Millennium Post
Cell of South Delhi

The Special Task Force (STF) of Uttar Pradesh arrested six


4. more accused of gang involved in the recent police India TV
recruitment exam paper leak from Uttar Pradesh

5. Details on ₹157 Crore Cyber-Attack in Telangana Bizz Buzz

6. A man lost Rs 72.3 lakh due to an online trading scam Times of India

Cops warn netizens after receiving several complaints of KYC


7. Times of India
fraud related to the banking app

र ां ची में किर ये पर मि न लेिर फर्जी बैंि वेबस इट िे र्जररये


8. News Wing
स इबर ठगी िरनेव ले तीन आरोपी कगरफ्त र
International

S. No. News Source


Hackers Use Number of Legitimate Tools in
GB Hackers
1. Ransomware Attacks

Hacked WordPress sites use visitors' browsers to hack


2. other sites Bleeping Computer
National
How a 21-year-old student in Rajasthan trained an army
of 500 youths in online fraud, fake stock
fraudsters were trained to pose as
A 21-year-old man, Yogesh Meena, was
salespersons on popular trading platforms,
arrested on March 1 in Bundi district,
adding people to their Telegram groups and
Rajasthan for allegedly training around 500
sending fake stock postings to trick them into
youngsters from his village in cyber fraud.
investing. Once the victims sent money, the
He was apprehended along with three others,
fraudsters would block their numbers or
one of whom was a minor. Yogesh is
disable their Telegram channels.
believed to be behind at least 50 cases of
cyber fraud committed in the past year. The search for Yogesh began after the
During the arrest, police recovered a gold cybercrime branch received a complaint
ring from Yogesh and Rs 82,000 cash along about a Rs 1 lakh fraud in September last
with four cellphones from the other three year. The victim had been added to a
accused. Telegram channel by the fraudsters, who
promised high returns on stock trading
The police investigation revealed that
investments. Based on the complaint, a case
Yogesh selected youths from three villages in
was registered and the investigators traced
Bundi and Sawai Madhopur districts - Rawal,
the money trail to a bank account linked to a
Babai, and Chamanganj - for his training
19-year-old student named Dayaram Meena.
sessions. He is a BA student at a college in
Dayaram, a Class 11 student from Babai,
Sawai Madhopur and is said to have learned
revealed Yogesh's involvement when he was
the art of conning from another villager,
arrested on March 1.
whose whereabouts are currently unknown.
Yogesh admitted to training at least 500
According to Sandeep Ahlawat, inspector of
youths in cyber fraud, a scheme reminiscent
cybercrime in Manesar, Yogesh conducted
of the notorious cybercrime hub in Jamtara,
hour-long classes for the youths, teaching
Jharkhand. Along with Dayaram, Vikas
them how to operate Telegram channels and
Meena from Chamanganj and a 15-year-old
communicate with potential targets. The
juvenile from Bundi, both trained by Yogesh,
were also apprehended. Dayaram cheated 30
people, Vikas conned 12, and the juvenile
scammed four individuals.

International loan app scam unravels with arrest of four


in Chandigarh
The arrested accused, Adesh Kumar, Tanveer based victim, who had lost ₹43.8 lakh to
Khan and Wazid of Ghaziabad, and Mahfooz scammers, reported the matter.
Alam of Mayur Vihar landed in the police
The cops scrutinised bank records, used
net,
technical
approximately
surveillance,
five months
and relied on tip
after a
offs to crack the
Chandigarh-
case. Based on
based victim,
certain inputs,
who had lost
they carried out
₹43.8 lakh to
raids in
scammers,
Rajender
reported the matter
Nagar, Ghaziabad, from where the accused
Cracking down on a loan application scam, in were arrested. Notably, Tanveer Khan and
which criminals would extort victims by Wazid were previously arrested by the
sending manipulated nude photos to their Madhya Pradesh police for cyber fraud and
contacts, cyber sleuths dismantled a Dubai- were on bail at the time of this incident.
based syndicate with the arrest of four gang
The case
members, police said on Wednesday.

In her complaint, the Chandigarh-based


The arrested accused, Adesh Kumar, Tanveer
victim, a constable, said that she fell prey to
Khan and Wazid of Ghaziabad, and Mahfooz
the scammers in March 2023, when intrigued
Alam of Mayur Vihar landed in the police
by a mobile notification from “Real Money”
net, approximately five months after a city-
application, she unwittingly installed the app
on her phone. Subsequently, the app

*Reference links mentioned on last page of report Page 5 of 18


requested her bank account details, which led companies using the identities of his
to an unauthorised transfer of ₹1,800. associates, Adesh Kumar and Tanveer Khan.
Though she tried to refund the sum, the
He had also opened current bank accounts in
application did not allow her to do so. This
different banks in the name of these firms by
triggered a series of harassing messages and
using his gang members’ documents. He sent
calls demanding repayment through various
these account details and SIM cards to
loan applications – See Money, Hello Cash,
Mahfooz Alam, who was in turn, in contact
One Cash, S Cash, Sea Money, D Money,
with other fraudsters through an encrypted
Okay Lends, T Loan, Swift Loan, U Cash,
messaging service.
Fast Cash.

When his accomplices confirmed the bank


The scammers, who had access to her contact
account and SIM card details, he provided
list and mobile gallery, started threatening to
them a different address in the Delhi NCR
send morphed obscene photographs to her
and asked them to send the bank account kit
contacts. They managed to coerce her into
along with the registered SIM card through
transferring approximately ₹43.8 lakh to
courier.
multiple bank accounts associated with the
scam through UPI payments. She also
Alam received a percentage on each
received some amount from these loan
transaction exceeding ₹1 crore, passing on a
applications in her bank accounts.
share to Wazid for providing the necessary
accounts. The syndicate utilised 10 accounts
Modus operandi
for their activities, resulting in multi-crore
Police said that Wazid, who controlled the transactions through the fraudulent loan
bank accounts, was the mastermind of the application scam.
operation. He had established many shell
A cyber fraud ring that duped public through customer
care numbers listed on Google has been dismantled by
the Cyber Cell of South Delhi
dismantled by the Cyber Cell of South Delhi,
A cyber fraud ring that duped innocent
Ankit Chauhan, DCP South Delhi said on
individuals through counterfeit customer
Tuesday.
care numbers listed on Google has been

*Reference links mentioned on last page of report Page 6 of 18


The police received the information about the The comprehensive investigation was led by
fraud ring through a complaint registered at the team of the Cyber Cell of the Delhi Police
the Cyber who utilised
Police Station technical
South. analysis and
surveillance to
The arrested
trace the
accused was
fraudulent
identified as
transactions to
Ritik Kumar
a bank account
(23) son of Raj
in Patna, Bihar.
Kumar resident
of Bagicha Nakhaspind, Patna, Bihar, Subsequent raids in Patna resulted in the
Manish Kumar (20) son of late Dilip Prasad arrests and the recovery of six mobile phones,
resident of Ummad Gali, Begampur, Near a passbook, an Aadhar Card related to the
Patna Sahib Railway Station, Bihar, and beneficiary account, and a SIM card linked to
Sanjay Kumar (28) son of Anil Prasad the account.
resident of Gulmhiya Sabalpur, Patna, Bihar
During interrogation, the accused revealed an
According to the Police, the arrests were elaborate scheme involving the purchase and
made following a detailed investigation into sale of bank accounts for committing fraud,
a complaint by a resident of Panchsheel Park, implicating links to Jamtara, Jharkhand – a
New Delhi, who reported being swindled out region infamous for cybercrimes.
of Rs 1,29,000.
The main accused, Ritik Kumar, disclosed
The victim sought customer support for a his association with a network that posts fake
defective domestic flour machine, only to be customer care numbers on Google,
tricked by the fraudsters operating through employing these for various services through
fabricated contact numbers found on Google. Google ads, further illustrating the
sophisticated nature of their operation.
A case was registered under sections 420/34
of the Indian Penal Code at the Cyber Police
Station, South District.

*Reference links mentioned on last page of report Page 7 of 18


The illicit proceeds were primarily used to The arrested individuals hail from various
finance these advertisements, thereby locations in Bihar, with ages ranging from 20
perpetuating the cycle of fraud. to 28 years

The Special Task Force (STF) of Uttar Pradesh arrested


six more accused of gang involved in the recent police
recruitment exam paper leak from Uttar Pradesh
The Special Task Force (STF) of Uttar on February 7 and 8, 2024, were
Pradesh arrested six more accused of gang made available to residents of
involved in the recent police recruitment Haryana named Pravesh Pradhan,
exam paper leak from Muzaffarnagar, Gulzar and Gaurav.
officials said. The arrest was made on March  Pravesh Pradhan, Gulzar, Asif, and
5 from Meerut. The STF team also recovered Gaurav had obtained the
eight mobile phones along with question aforementioned question paper and
papers and answer keys. answer key from Rohit alias Lalit.
 Rohit alias Lalit had procured the
A gang was involved in the question paper
question paper and answer key from
leak of the written examination conducted by
Deepu alias Deepak.
the Uttar Pradesh Recruitment and
 Deepu alias Deepak, Bitadhu Singh,
Promotion Board on February 17 and 18.
Pravesh Pradhan, Asif, Monu, and
More than 48 lakh candidates had appeared
Gulzar takes contract of getting the
in the examination, which was held on
papers out for the recruitment
February 17 and 18 across the state, for over
examinations.
60,000 constable recruitment posts in Uttar
 Deepu alias Deepak and his
Pradesh. A re-examination will be conducted
associates receive the question papers
within six months.
and answer keys for recruitment
examinations from someone residing
Following a collective investigation and
in Haryana.
scrutiny, the following facts came to light:
 Praveen, Rohit alias Lalit, Navin
 The question paper and answer key of Kumtar, Sahil, Dabbu, and Gaurav
the second shift of the Uttar Pradesh procure the papers for the candidates.
Police recruitment examination held

*Reference links mentioned on last page of report Page 8 of 18


These people receive Rs 8 to 0 lakh from Mishra. Mishra wa replaced with IPS officer
each candidate for the said work. Rajeev Krishna. Mishra was put on the "wait
list" after her
Legal action
removal from
under sections
the post and
466, 420, 467,
Director
468, 471, and
Vigilance
20B of the
Krishna was
Indian Penal
given the
Code, as well as
additional
sections 3, 4, 7,
responsibility
8, and 9 of the
of the board.
Public Examination Act, is being initiated
against the arrested accused at Kankerkhera The action came days after the UP police
Police Station, Meerut district. constable recruitment examination was
cancelled following allegations of a question
UP Police Recruitment Board chairperson
paper leak. The state government on
removed
February 24 cancelled the police constable
recruitment examination, adding that a re-
This came a day after the Uttar Pradesh
examination would be conducted within six
government removed the Chairperson of the
months.
UP Police Recruitment Board Renuka

Details on ₹157 Crore Cyber-Attack in Telangana


₹157 crores were stolen by cybercriminals February. Only about ₹5 crore has been
from the people of Telangana in February frozen thus far.
2024. The Telangana State Cyber Security
‘’Since the 1930 helpline was simplified in
Bureau (TSCSB) received reports of 9,661
January 2024, there has been an upsurge in
cybercrime incidents, with 8,088 of those
reports of cybercrimes of this kind. We also
incidents involving financial fraud.
have cyber warriors in every police station,
According to official statistics, 7,672 cases
which has reduced some load of the status
involving the top five MODUS Operandi
calls from the central system," said Shikha
(MO) resulted in a loss of over ₹119 crore in
Goel, Director of TSCSB.

*Reference links mentioned on last page of report Page 9 of 18


Telangana Cybersecurity Challenges forthcoming Initial Public Offerings (IPOs)
through institutional stock market
With 3,143 cases, the most common type of
investment.
identity theft was financial fraud, specifically
involving credit/debit card fraud, Aadhaar With customers losing more than ₹2 crore,
Enabled Payment System (AePS) fraud, loan frauds remained one of the top five MOs
customer service scams posing as FedEx, for this month as well. Most of the time, con
Blue Dart, or banks, and income tax fraud. artists would pester their victims into paying
The public was duped out of ₹23 crore by more money by sending their morphed
fraudsters who offered services such as card photos to their contacts. According to
blocking, increased card limits, updated TSCSB officials, e-commerce platform
KYC, PAN card linking, card replacement, advertisement fraud is still on the rise. They
and reward points. claimed that sincerely believed
advertisements shared on these forums had
Cybercrime Loss in Telangana
led people to lose more than ₹5 crore to
fraudsters. Cybercrime is constantly evolving
During the month, 1,822 cases of business
and knows no borders, so it's crucial to stay
and investment fraud were reported, resulting
vigilant and not fall victim to the latest
in a loss of close to ₹84.5 crore. Within this
schemes, according to Ms Goel. She also
subset, there has been an upsurge in stock
emphasized the importance of reporting
market trading scams aimed at unsuspecting
incidents promptly to prevent further harm.
investors, particularly those who are lured in
by the promise of pre-allotment in
A man lost Rs 72.3 lakh due to an online trading scam
A man lost Rs 72.3 lakh due to an online basic verification procedures, including
trading scam. According to the complaint, on address verification, he was added to a
Jan 11, while browsing Facebook, he WhatsApp group and claimed that there were
encountered an advertisement related to the over a lakh members.
stock market.
Encouraged by the group’s activities, he
Intrigued, he clicked on the ad, leading him invested Rs 50,000 in stock pull-up, block
to download two apps Angel bok and Angel trade and IPO on Jan 18.
bg, through a provided link. After completing

*Reference links mentioned on last page of report Page 10 of 18


Subsequently, he continued purchasing When he expressed his intention to sell his
shares and deposited Rs 72.3 lakh into shares, he was informed that he needed to pay
different bank accounts as instructed. a 10% tax. A case has been registered at CEN
police station and an investigation is on.

Cops warn netizens after receiving several complaints of


KYC fraud related to the banking app
After receiving several complaints of KYC viral on the social media. Cops visit various
fraud related to the banking app of a leading housing complexes every weekend to
public sector bank, cops made posters and sensitize people about cyber security. The
cartoons to caution netizens against the Kolkata Police also launched a video to
perils of sharing personal data over phone generate awareness among people and spread
calls. the message that online security is as
important as physical security. “People need
“The bank customers were informed by the
to understand that banking fraud happen
fraudsters that unless the KYC details are
when someone is in haste. The video cites
shared with the caller, their apps would
that sharing of OTPs or PIN is not needed to
become dysfunctional,” claimed an officer.
receive money,” said the officer.

The awareness advertisements by both


Kolkata and Bidhannagar police have gone
र ांची में किर ये पर मि न लेिर फर्जी बैंि वेबस इट िे र्जररये
स इबर ठगी िरनेव ले तीन आरोपी कगरफ्त र

फर्जी बैंि वेबस इट बन िर ठगी िरनेव ले तीन स इबर अपर कियोां िो सीआइडी िी स इबर क्र इम थ न
पुकलस ने कगरफ्त र किय है . आरोकपयोां ने र र्जि नी र ां ची िे ल लपुर में किर ये पर मि न ले रख थ . वहीां से
स इबर ठगी िी घटन िो अांर्ज म दे रहे थे . कगरफ्त र आरोकपयोां ने ह ल ही में ठगी िे पै से से ब्रेर्ज ि र िर
खरीदी थी. इस ि र िी मदद से कवकिन्न एटीएम में घू म-घूम िर ठगी िे पैसे कनिलते थे .

कगरफ्त र आरोकपयोां में कबह र िे न लांद कर्जले िे ितरीसर य थ न क्षेत्र गौरै य कनव सी करांस र र्ज, पल मू िे
लेस्लीगांर्ज थ न क्षेत्र स्थूत िनग ां व कनव सी सुकमत िुम र और र्ज मत ड़ कर्जले िे िरम ट ां ड़ स्स्थत दे ओल्बरी
कनव सी उमेश िुम र रर्जि िे न म श कमल हैं . आरोकपयोां िे प स से नौ मोब इल, एि र उटर, एि टै बलेट,
नौ कसम, दस डे कबट ि डड , तीन क्रेकडट ि डड , एि बेकसि पेमेंट ि डड ओर ि ण्ड से सांबांकित ड ट पुकलस ने

*Reference links mentioned on last page of report Page 11 of 18


बर मद किय है . आरोपी िो रकतकबांब पोटड ल िी मदद से पिड़ गय है . रकतकबांब पोटड ल िे म ध्यम से पुकलस
िो र्ज नि री कमली कि िुछ स इबर अपर िी बड़े पैम ने पर कवकिन्न HDFC,ICICI,SBI,PNB िे KYC
UPDATE िरने िे कलए बैंिोां िे ख त ि रिो िो Internet Banking िे Android Application ि Fake
Application एवां फर्जी Website ि Phishing URL (Link) ि Bulk SMS िेर्ज िर स इबर ठगी िरने
ि ि म िर रहे हैं . फर्जी कलांि िो र्जब लोग स्िि िरते हैं तो Internet Banking ि Fake App उनिे
फोन में Install हो र्ज त है . र्जब लोग उस App िो Open िरते हैं तो स इबर अपर कियोां द्व र उनि Data
Dash Board िे म ध्यम से सांरकक्षत िर कलय र्ज त है . इसिे ब द एि उां ट से रुपय कनि ल लेत थ .

इस अपर ध शैली से बचने ि तरीि

 किसी अज्ञ त मोब ईल नम्बर से िॉल आने पर अपनी िोई कनर्जी र्ज नि री स झ न िरें .
 किसी िी अज्ञ त नम्बर
से आये एसएमएस में
कदये अज्ञ त सांकदग्ध
कलांि पर स्िि न
िरें .

 Google Play Store ि रयोग िरने से पहले Google Play Protect िी सुकवि ि रयोग िरें तथ
बैंि से सांबांकित किसी िी Application पर सांदेह होने पर नर्जदीिी बैंि श ख से सां पिड िरें .
 Internet Search Engine, Google Ads एवां अन्य सोशल मीकडय प्लेटॉफमड पर कदये Customer
Care/Helpline Number पर िरोस न िरें । Customer Care Number िे कलए हमेश Official
Website पर सांपिड िरें .
 किसी िी अज्ञ त व्यस्ि द्व र िेर्जे गये Unknown कलांि य URL पर न स्िि िरें न ही किसी अन्य
नम्बर पर Forward िरें । बैंिो िे UPI Application से सांबांकित रकर्जस्ट्र े शन िे कलए बैंिो िे Official
Number से ही मैसेर्ज आत है .
 स ईबर अपर ि ि कशि र होने पर हे ल्पल ईन नम्बर-1930 तथ ऑनल ईन
www.cybercrime.gov.in पर ररपोट िरें .

*Reference links mentioned on last page of report Page 12 of 18


International
Hackers Use Number of Legitimate Tools in
Ransomware Attacks
Initially, it adds an extra layer of coercion, as
Ransomware attacks remain a formidable
the attackers threaten to publish the stolen data
challenge for organizations worldwide.
if their demands are not met.

These attacks not only encrypt critical data,


Secondly, it provides an additional revenue
rendering it inaccessible to the rightful owners
stream, as this data can be sold on the dark web
but increasingly involve the exfiltration of
or used in further targeted attacks.
sensitive information.
The sophistication of these operations has
This dual-threat approach amplifies the
increased, with attackers leveraging legitimate
potential damage, as attackers not only
administrative and security tools to avoid
demand ransom for the decryption key but also
detection and facilitate their malicious
threaten to release the stolen data unless
activities.
additional payment is made.
List of Legitimate Tools Used in Ransomware
A critical aspect of these attacks that often goes
Attacks
unnoticed is the use of legitimate tools by
hackers to carry out their nefarious activities. The use of legitimate tools by hackers
complicates the detection and prevention of
Symantec researcher’s report delves into the
ransomware attacks.
phenomenon, highlighting the tools commonly
repurposed by cybercriminals. These tools, designed for system
administration, network management, and
Data exfiltration refers to the unauthorized
security assessments, are repurposed to
transfer of data from a computer or server.
conduct reconnaissance, gain persistence,
escalate privileges, and exfiltrate data, reads
In the context of ransomware attacks, it serves
Symantec report.
a dual purpose.

*Reference links mentioned on last page of report Page 13 of 18


PowerShell: A powerful scripting language Its beacon component is particularly useful for
and command-line shell, PowerShell is often maintaining communication with
used by attackers for its ability to execute compromised systems.
scripts and commands across the network,
Rclone: Rclone is a command-line program to
automate tasks, and manage configurations.
manage files on cloud storage. It has been
Its widespread availability on Windows repurposed by attackers for data exfiltration,
systems makes it a favored tool for initiating leveraging its capabilities to efficiently
attacks and moving laterally across networks. transfer large volumes of data to cloud services
under their control.
PsExec: Part of the Sysinternals Suite, PsExec
allows administrators to execute processes on 7-Zip: A file archiver with a high compression
other systems remotely. ratio, 7-Zip is used by attackers to compress
stolen data before exfiltration.
Hackers use it to spread malware across
networked computers, execute ransomware This reduces the bandwidth required for the
payloads, and maintain persistence within the transfer and helps evade detection by
compromised environment. minimizing the number of outbound
connections.
Mimikatz: This open-source utility is designed
to extract plaintext passwords, hash, PIN WinRAR: Similar to 7-Zip, WinRAR is
codes, and Kerberos tickets from memory. another compression tool used to package data
before exfiltration.
Attackers commonly use Mimikatz to escalate
privileges and gain access to high-value targets Its widespread use and support for various
within the network. compression formats make it a versatile tool
for attackers.
Cobalt Strike: Although intended as a security
tool for penetration testers, Cobalt Strike has Advanced IP Scanner: This network scanner
been adopted by cybercriminals for its robust allows for quick identification of all devices on
set of features for network reconnaissance, a network.
exploitation, and the deployment of payloads.

*Reference links mentioned on last page of report Page 14 of 18


Attackers use it to map out the network, It underscores the importance of robust
identify potential targets, and plan their attack network monitoring, the principle of least
vectors. privilege, and continuous education on the
evolving tactics of cyber adversaries.
The use of legitimate tools in ransomware
attacks presents a unique challenge for By understanding the tools and methods used
cybersecurity professionals. by attackers, organizations can better prepare
their defenses against the multifaceted threat
These tools are often whitelisted within
of ransomware.
organizations, making malicious activities
harder to detect.

Hacked WordPress sites use visitors' browsers to hack


other sites
Hackers are conducting widescale attacks on These scripts have become very common over
WordPress sites to inject scripts that force the past year, with threat actors creating fake
visitors' browsers to bruteforce passwords for Web3 sites with wallet drainers. They then
other sites. hack X accounts, create YouTube videos, or
take out Google and X advertisements to
The campaign was first spotted by website
promote the sites and steal visitor's
cybersecurity firm Sucuri, which has been
cryptocurrency.
tracking a threat actor known for breaching
sites to inject crypto wallet drainer scripts. Sucuri researchers reported that the threat
actors were breaching compromised
Crypto wallet drainers are malicious scripts
WordPress sites to inject the AngelDrainer
that steal all cryptocurrency and assets when
wallet drainer in multiple waves from multiple
someone connects their wallet.
URLs, the last being
'dynamiclink[.]lol/cachingjs/turboturbo.js.'
When people visit these compromised sites,
the scripts display misleading messages to
In late February, the threat actor switched from
convince users to connect their wallets to the
wallet draining to hijacking visitors' browsers
site. However, once they do so, the scripts steal
to bruteforce other WordPress sites. using a
all the contained assets.

*Reference links mentioned on last page of report Page 15 of 18


malicious script from a newly registered inject malicious scripts, or encrypt files on the
domain 'dynamic-linx[.]com/chx.js'. site.

Building a bruteforce army As part of this hacking campaign, the threat


actors compromise a WordPress site to inject
According to a new report from Sucuri, the
malicious code into the HTML templates.
threat actor is using compromised WordPress
When visitors access the website, the scripts
sites to load scripts that force visitors' browsers
are loaded in their browser from
to conduct bruteforce attacks for account
https://dynamic-linx[.]com/chx.js.
credentials on other websites.
These scripts will cause the browser to quietly
A bruteforce attack is when a threat actor
contact the threat actors' server at
attempts to log in to an account using different
'https://dynamic-linx[.]com/getTask.php' to
passwords to guess the correct one. With the
receive a password bruteforcing task.
credentials, the threat actor can steal data,

*Reference links mentioned on last page of report Page 16 of 18


News / Feeds References
National

1. https://economictimes.indiatimes.com/news/india/jamtara-in-bundi-how-a-21-year-old-
student-in-rajasthan-trained-an-army-of-500-youths-in-online-fraud-fake-stock-
returns/articleshow/108256545.cms?from=mdr
2. https://www.hindustantimes.com/cities/chandigarh-news/international-loan-app-scam-
unravels-with-arrest-of-four-in-chandigarh-101709764538111.html
3. https://www.millenniumpost.in/delhi/cyber-cell-cracks-down-on-fake-customer-care-
scam-554794
4. https://www.indiatvnews.com/uttar-pradesh/up-police-recruitment-exam-paper-leak-
case-stf-arrests-six-accused-meerut-latest-updates-2024-03-06-920158
5. https://www.bizzbuzz.news/national/details-on-157-crore-cyber-attack-in-telangana-
1296703
6. https://timesofindia.indiatimes.com/city/mangaluru/man-loses-72l-in-online-trading-fraud-
mangaluru-news/articleshow/108250007.cms
7. https://timesofindia.indiatimes.com/city/kolkata/kolkata-cops-warn-netizens-of-kyc-
fraud/articleshow/108280290.cms
8. https://newswing.com/three-accused-arrested-for-cyber-fraud-by-taking-house-on-rent-
in-ranchi-through-fake-bank-website/728028/

International
1. https://gbhackers.com/legitimate-tools-ransomware/
2. https://www.bleepingcomputer.com/news/security/hacked-wordpress-sites-use-visitors-
browsers-to-hack-other-sites/

*Reference links mentioned on last page of report Page 17 of 18


*Reference links mentioned on last page of report Page 18 of 18

You might also like