Easy money, social networks and prison as the reward

Some months ago my colleague Roel Schouwenberg wrote a blog post about a money mule recruitment campaign through Facebook. We’ve been monitoring this activity and found new, quite active and successful campaigns of the same recruitment purpose and in the same social network but with a bit different approach: creating groups to follow.

An example of one of such groups:

The criminals promise that= their potential mules will get more than $ 6,000 USD per month and will only need to work no more than
18 hours a week. The mule site has a GeoIP javascript, which customizes some parts of the offer according to your current geographical
location. So, it’s another old, but in some cases, effective trick to lure more potential mules.

I was surprised to see how many followers this money mule group had:

We’re talking about 224 thousand people! Who knows how many of them accepted the offer to be a money mule?= When I checked
the list of members of the group I even found some people I had met personally in my life.

It’s always important to remember that the criminals behind online money stealing are in a better (safer) position than their
mules. They also get the biggest part of the money. And what about mules…? The mules, instead of money, get to go to jail. If someday you receive an invitation by email, IM or some social network to be a part of such business, don’t let to be fooled by the criminals; odds are you’ll get prison time, not free money.

Easy money, social networks and prison as the reward

Your email address will not be published. Required fields are marked *



GhostEmperor: From ProxyLogon to kernel mode

While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. With a long-standing operation, high profile victims, advanced toolset and no affinity to a known threat actor, we decided to dub the cluster GhostEmperor.

APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

Subscribe to our weekly e-mails

The hottest research right in your inbox