Dubai, November 23, 2022 — Group-IB, one of the global leaders in cybersecurity, has identified 34 Russian-
Classiscam graduates
By tracking the evolution of the popular scam scheme Classiscam, Group-IB Digital Risk Protection analysts revealed how some “workers” (low-rank online scammers) started shifting to a more dangerous criminal scheme that involves distributing info stealers. Moreover, the illicit business of stealers, which is coordinated via Telegram groups, uses exactly the same operational model as Classiscam.
An info stealer is a type of malware that collects credentials stored in browsers (including gaming accounts, email services, and social media), bank card details, and crypto wallet information from infected computers, and then sends all this data to the malware operator. After a successful attack, the scammers either obtain money themselves using the stolen data, or they sell the stolen information in the cybercriminal underground. According to Group-IB, stealers are one of the top threats to watch in the coming year. The threat actor responsible for the most recent attack on Uber purchased the credentials compromised with the Racoon stealer.
According to the Group-IB Digital Risk Protection team, (part of the Unified Risk Platform), the mass Telegram groups and bots designed to distribute info stealers first appeared in early 2021. By investigating a number of accounts, Group-IB analysts were able to confirm that members of several scam groups that previously participated in the Classiscam scheme began using stealers. In 2021 and 2022, Group-IB experts identified 34 active groups on Telegram. On average, such info stealer distribution groups have around 200 active members.
The most popular stealer among the groups examined by Group-IB is RedLine, which is used by 23 out of 34 gangs. Racoon ranks second: 8 groups employ this tool. Custom stealers are used in 3 communities. Administrators usually give workers both RedLine and Racoon in exchange for a share of the stolen data or money. However, the malware in question is offered for rent on the dark web for $150-200 per month. Some groups use 3 stealers at the same time, while others have only one stealer in their arsenal.
Having switched from scamming users of classified websites to stealers, some threat actors reproduced not only the hierarchy and model of Classiscam, but also its technical capabilities. In particular, Telegram bots that generate malicious content, communication between members, and all their shady accounting. The tasks of workers, the scammers of the lower-ranks, have also changed — they must now drive traffic to bait scam websites impersonating well-known compa
World tour
Group-IB estimates that between March 1 (when Group-IB started researching the scheme
The top 5 most often attacked countries in 2022 were the United States, Brazil, India, Germany
In the United Arab Emirates, for instance, last year (March - December 2021), the operators of the stealers in question infected 2,491 devices. In the first seven months of 2022, the number grew to 5,549. From these devices the scammers were able to retrieve 532,046 passwords (up from 135,569 from March-December 2021), 389 sets of payment records, and 614 sets of crypto wallet information such as credentials, seed phrases, etc.
In the Kingdom of Saudi Arabia, last year (March - December 2021), the operators of the aforementioned stealers infected 3,341 devices. This almost doubled in the first seven months of 2022 to 6,302. From these devices, the scammers retrieved 725,218 passwords (up from 220,804 from March-December 2021), 1,395 sets of payment records, and 401 sets of crypto wallet information.
According to the analysis of Telegram groups, for the last 10 months of 2021 cybercriminals collected 27,875,879 sets of passwords, 1,215,532,572 cooki
According to Group-IB, in 2021, threat actors worldwide most frequently collected PayPal account credentials (more than 25%) and Amazon credentials (more than 18%). In 2022, the most targeted services are the same, namely PayPal (more than 16%) and Amazon (more than 13%). However, over the course of the year, cases of stealing passwords for gaming services (Steam, Epic Games, Roblox) in the logs have increased almost five-fold.
“The influx of a huge number of workers into the popular scam Classiscam — which Group-IB’s Unified Risk Platformidentified, at its peak, comprised over a thousand criminal groups and hundreds of thousands of fake websites — has led to criminals competing for resources and looking for new ways to make profits,” says Sharef Hlal, Head of Group-IB's Digital Risk Protection Analytics Team in Dubai. “The popularity of schemes involving stealers can be explained by the low entry barrier. Beginners do not need to have advanced technical knowledge as the process is fully automated and the worker's only task is to create a file with a stealer in the Telegram bot and drive traffic to it. For victims whose computers become infected with a stealer, however, the consequences can be disastrous.”
To minimize potential risks, Group-IB Digital Risk Protection experts recommend that users refrain from downloading software from suspicious sources, use isolated virtual machines or alternative operating systems for installation, avoid saving passwords in browsers, and regularly clear browser cookies. To prevent digital risks and unwanted consequences, companies should take a proactive approach to their brand’s digital security and use modern technologies for monitoring and response, such as Group-IB’s Digital Risk Protection.