Hack 4 Career

www.hack4career.com

mertsarica

Hack 4 Career Copyright © by Mert SARICA. All Rights Reserved.

This book was produced with Pressbooks.

Contents

Introduction

1. Troll Hunting

2. Deepfake Scammers

3. Information Thieves

4. Investment Scammers

1

Introduction

In 2009, inspired by the belief that “knowledge is power and grows when shared,” I launched my blog to shine a spotlight on information security through a wide range of technical articles. Over time, the enthusiasm and kind words from my readers encouraged me to take the next step: gathering each year’s posts into an e-book, making them easily accessible to fellow cybersecurity enthusiasts.

I poured my time, effort, and resources into researching and writing these articles, and my hope is that they will prove helpful to anyone eager to deepen their understanding and sharpen their skills in the cybersecurity field.

Mert SARICA
https://www.hack4career.com
https://twitter.com/MertSARICA
https://www.linkedin.com/in/mertsarica
CCISO, CISSP, SSCP, OSCP, CREA, CEREA

1

Troll Hunting

Introduction

In recent years, we have seen the increasing importance of cyber threat intelligence for organizations. As a result, the number of products and services used for this purpose within organizations has been growing rapidly. Firstly, cyber threat intelligence provides a significant advantage to organizations by helping them identify threat actors targeting their industry, understand the tactics, techniques, and procedures they employ, and prepare for potential cyber attacks. Furthermore, when organizations are exposed to a cyber attack, cyber threat intelligence can shed light on various aspects of the incident, from enriching the data collected during the Incident Response process to establishing connections with threat actors.

Not only organizations but also end users who are closely intertwined with technology, individuals like us, need to remember that we can benefit from cyber threat intelligence and platforms in some cases (such as Troll account investigation).

What is Troll, Trolling and Disinformation?

As in all over the world, we witness the proliferation of messages shared by Troll accounts on social media and in the media, with the aim of manipulating the masses with disinformation attack. Sometimes, these false pieces of information can be shared from individuals’ own accounts, as well as through fake, anonymous accounts.

In slang, a troll is a person who posts or makes inflammatory, insincere, digressive, extraneous, or off-topic messages online (such as in social media, a newsgroup, a forum, a chat room, an online video game) or in real life, with the intent of provoking others into displaying emotional responses, or manipulating others’ perception, thus acting as a bully or a provocateur. The behavior is typically for the troll’s amusement, or to achieve a specific result such as disrupting a rival’s online activities or purposefully causing confusion or harm to other people. (Source: Wikipedia)

Disinformation attacks involve the intentional dissemination of false information, with an end goal of misleading, confusing, or manipulating an audience. False information that is not intentionally deceptive is referred to as misinformation, although that has also been used as a catch-all term. Disinformation attacks may be executed by political, economic or individual actors to influence state or non-state entities and domestic or foreign populations. These attacks are commonly employed to reshape attitudes and beliefs, drive a particular agenda, or elicit certain actions from a target audience. Tactics include the presentation of incorrect or misleading information, the creation of uncertainty, and the undermining of both correct information and the credibility of information sources. (Source: Wikipedia)

From 2009 until now:

I have shared over 200 technical cybersecurity articles on my blog in both English and Turkish, with the motto ‘Knowledge is power and grows as it is shared’ Since 2015, I have organized the ‘Pi Hediyem Var‘ cybersecurity game, through which I have gifted more than 15 Raspberry Pi devices to university students with the support of my sponsors. I have been a speaker at nearly 30 cybersecurity events. With my presentations titled ‘Ethical Hacking and Career,’ I have guided thousands of students interested in the field of cybersecurity in almost 40 universities.

Despite all my hard work, I am rarely targeted by troll accounts and in some cases the reason is just because I moved to the United States in 2022.

Examples of Trolling

Most of the time, troll accounts have already closed their accounts, deleted their messages, or received responses before I can even understand what’s happening, thanks to the reactions and criticisms from followers who don’t doubt my good intentions even for a moment. In such cases, there is often no need for me to rely on cyber threat intelligence or platforms. However, in situations like my blog posts titled “WhatsApp Scammers,” “Exposing Pig Butchering Scam,” I personally benefit greatly from cyber threat intelligence and platforms when dealing with scammers.

*Message deleted*

In this screenshot, someone shared a message regarding my LinkedIn message and tried to mislead, confuse, or manipulate people. On the left side, you see my post in English, and on the middle, you see his post in Turkish. After he received reactions and criticisms from my beloved connections/followers, he had to delete his message.

Here is the English translation of his message;

“Hello, I’d like to share a concern that has been bothering me. On this platform, especially the posts of our fellow members who are about to start working abroad can be quite disturbing. I’ve had international experience myself, but I have never used a belittling tone when referring to the beautiful lands of Anatolia and my beloved Turkey, where wonderful people live. In a recent post, I saw a job opportunity shared with the title “GENIUS AMERICA VISA.” Cemeteries are filled with irreplaceable individuals. I recommend that those who write such messages do not forget this. One final reminder: “No matter where the fox goes, he shall end in the furrier’s shop.”

*Message deleted*

In another screenshot, someone acted as a bully or a provocateur with falsified claims about me. After he received a reaction and criticism from one of my beloved followers, he had to delete his message.

Here is the English translation of his messages;

“I have sent what I had to the necessary places. I just want to share one more thing. I’m talking about the guy who just gifts Raspberry Pi for the sake of building public relations (PR), organizes competitions, and then leaves people hanging in the same way.”

“In short, newcomers to the industry, don’t follow such people. Research well, don’t be misled. Someday, you may find yourself speaking well and advertising, but you may lack the technical capability.”

Especially when you insult, use profanity, engage in character assassination, spread false accusations, threaten, or criticize someone’s patriotism directly or indirectly on social media, you should always remember that sooner or later, this will come back to haunt you. Even if you regret your actions and delete your messages for a reason, it’s not something that can be easily erased from records and memories.

At times, when you receive a suspicious, malicious or evil message via email, social media, or a network, you can also benefit from cyber threat intelligence platforms to understand the intentions and identity of the person behind it.

In this example, someone first insulted me through my website via email, and then, after not being responded to for a month, attempted to make contact via social media with a different approach.

Here is the English translation of his e-mail;

“Now it’s time to light the henna, you’re basically saying that all your success only managed to get you as far as being a doorman of the United States. If you had listened the songs of Barış Manço, you wouldn’t have ended up like this. With this mindset, you won’t achieve much, but one day, you might just become the handle of a hoe.”

Here is the English translation of his LinkedIn message;

“Good day, Mr. SARICA. I’m Cemal, and I work as a computer science teacher. I have completed my master’s degree in cybersecurity. I would like to advance in this field and benefit from your extensive experience as a master in the field. I would greatly appreciate it if we could have a discussion at a convenient time. You can also reach me on WhatsApp.”

When I searched the email address in the SOCRadar Cyber Threat Intelligence Platform, I easily gained insights and information about his intentions and motivations, such as learning that the individual has been active in hacker forums for years.

If you work for a cyber threat intelligence firm that tracks threat actors, cybercriminals, and scammers, and shares intelligence related to their operations, there may be times when you encounter threatening messages targeting your organization through anonymous accounts on social media. In such situations, you can utilize your own platform as well as employ different methods.

In this example, an individual who was not allowed to register for the cyber threat intelligence platform due to failed security checks first sends threatening emails, and then starts trolling through an anonymous Twitter account.

*Account disabled*

In order to determine that a person who sends emails using their real identity and another person who shares messages through an anonymous Twitter account behind a Guy Fawkes mask are highly likely to be the same individual, we can rely on stylometric methods to identify the author based on the samples we have from the suspected person’s emails and the messages shared on the anonymous Twitter account. These stylometric methods involve analyzing various elements such as punctuation, spelling mistakes, emphasis, foreign words, slang and jargon, conjunctions, abbreviations, numbers, subject tags, and symbols.

By examining and comparing these elements, we can observe similarities or differences between the emails and the anonymous Twitter account, which can help us determine if they are likely authored by the same person. However, stylometric analysis alone cannot provide a definitive conclusion, as it relies on statistical patterns and probabilities. Therefore, it is important to consider additional factors and evidence when making a determination.

What is Stylometry?

Stylometry is a style identification method used primarily in written literature, but also in other artistic disciplines such as visual arts and music, as well as in fields like history, religion, law, and forensic sciences. Stylometric analysis is a method based on the examination of style markers as variable factors using statistical and computational techniques.

For approximately two centuries, stylometry has been applied to compare and analyze the literary styles of authors, particularly in the context of authorship attribution problems. The methods used in stylometry range from basic statistical calculations and tests to artificial neural networks. Stylometric studies have been conducted on various subjects, ranging from religious texts and historical documents to the examination of plagiarism in scientific works and the analysis of literary works and author styles. (Source: A Bridge From Statistics To Literature: The Stylometry Analysis – Ayşe İŞİ, Fatih ÇEMREK, Zeki YILDIZ)

Troll Hunting

At this stage, rather than conducting an extensive stylometric analysis, I decided to have a brief look at the 109 messages on the anonymous Twitter account and focus on common words and punctuation marks that overlap with the emails. Based on the notes I took, I noticed that the messages frequently used ellipsis (…..) punctuation marks and included the term “ghosted” which is not commonly encountered in English correspondence. When I examined the emails from the suspected individual, I found that my observations closely matched, significantly increasing the likelihood of similarity between the two individuals.

When I started thinking about what I would do if the number of messages shared on the anonymous Twitter account was not 109 but 10,009, I decided to seek the help of data science.

Data science is the field of study that involves working with data to extract meaningful insights and make predictions for business purposes. It is an interdisciplinary approach that combines principles and practices from mathematics, statistics, artificial intelligence, and computer engineering to analyze large amounts of data. This analysis helps data scientists ask questions about what the data is, why it is the way it is, what it could become, and what can be done with the results. By employing data science techniques, professionals can uncover patterns, trends, and correlations within the data to drive informed decision-making and solve complex problems.

After conducting some research, I learned that I can leverage the similarity method in the Natural Language Processing (NLP) library called SpaCy, which measures the similarity between texts using Cosine Similarity.

Cosine Similarity is a measure that quantifies the similarity between texts in a vector space. It calculates how many times words appear in the texts. Then, each text is represented as a vector, with 1s and 0s indicating the presence or absence of words. When these vectors are placed in a three-dimensional space, the smaller the cosine angle between them, the closer the texts are to each other. For completely unrelated vectors, the cosine value is 0, while for completely opposite documents, the cosine value will be -1. (Source: A Content Recommendation System Application with TF-IDF Algorithm and Cosine Similarity on Netflix Data – Özlem GELEMET, Hakan AYDIN, Ali ÇETİNKAYA)

After I coded a tiny Python tool to examine the similarity between the emails from the person I suspected and the Twitter messages, with the help of the SpaCy library I concluded that they were highly likely sent by the same person. 🙂

Hope to see you in the following articles.

Note: For those who want to learn more about the use of stylometry, I recommend reading the free section of the book “Real-World Python: A Hacker’s Guide to Solving Problems with Code“.

2

Deepfake Scammers

Introduction

As of May 2024, we continue to witness the revolution and development of generative artificial intelligence with both excitement and concern. OpenAI showcased to the world in a launch event that with their newly announced GPT-4o, ChatGPT can engage in dialogue much more closely resembling human interaction, understanding and producing content from voice, text, and images. On the other hand, not wanting to fall behind in the AI wars, Google shared a new feature from its own generative AI, Gemini, shortly after OpenAI. With this feature, Gemini could instantly convey to the user what was happening in the surroundings and the current location through the camera application.

Well, if you ask what worries cybersecurity professionals and researchers the most alongside these developments that we follow with great excitement and curiosity, in my opinion, it can be how much these features facilitate or hinder fraud attempts and cyber attacks by scammers and threat actors. Just as with humanoid robots, the development in generative artificial intelligence is often compared to human or near-human productivity, which means that malicious individuals also benefit greatly, especially in creating visual, video, audio, and text deepfakes. OpenAI CEO Sam ALTMAN seems to share my concerns, as he recently announced that they are working on a tool to detect deepfake images created with OpenAI’s DALL-E 3 model.

What is Deepfake?

Deepfakes are synthetic media that have been digitally manipulated to replace one person’s likeness convincingly with that of another. Coined in 2017 by a Reddit user, the term has been expanded to include other digital creations such as realistic images of human subjects that do not exist in real life. While the act of creating fake content is not new, deepfakes leverage tools and techniques from machine learning and artificial intelligence, including facial recognition algorithms and artificial neural networks such as variational autoencoders (VAEs) and generative adversarial networks (GANs). In turn the field of image forensics develops techniques to detect manipulated images. (Source: Wikipedia)

We have seen that deepfakes have been frequently used for disinformation especially during the Russia-Ukraine war, fraud, and parody purposes in recent years. On the other hand, when we look at forums and Telegram channels where scammers and threat actors are frequently present, it is noticeable that messages shared about deepfakes and fraud services have increased. Naturally, this increase also raises the risk for individuals spending time on social networks to fall victim to such frauds and cyber attacks.

The Deepfake Gang

If you work at or receive services from a cyber threat intelligence firm like SOCRadar, which tracks the activities of threat actors and scammers and provides 24/7 intelligence to its clients, you have the opportunity to closely follow and stay informed about the suspicious and harmful activities carried out by malicious individuals across various platforms.

Based on information I recently obtained, I began closely monitoring a fraud gang that I believe to be based in Russia, with the technical details of their operations to be covered in another article. Since October 2023, this gang has been attempting fraud by using the names of international organizations such as Slovnaft, INA d.d, Bosphorus Gaz, and defense companies like Baykar, as well as Interpol. They targeted their victims through fake ads on Facebook, Instagram, Messenger, which are platforms under Meta. Occasionally, they also placed fake ads on Google‘s search page. To ensnare the citizens of their targeted countries, this gang did not hesitate to use deepfake images and videos of politicians, business people, and news anchors.

For example, in their ads targeting Turkish citizens, they used deepfake images and videos of well-known figures such as Selçuk BAYRAKTAR, Acun ILICALI, İsmail KÜÇÜKKAYA.

In one of the deepfake videos, it was promised that with a minimum investment of 8000 TRY, one could earn up to 100,000 TRY per month. When visiting the associated links, you would sometimes encounter a very simple form asking only for your first name, last name, email address, and mobile phone number. Other times, you would see a more visually rich form with multiple-choice options designed to gather more information, followed by a message stating that an operator would contact you shortly.

When examining the Facebook accounts used for these fake ads, it was highly likely that these accounts belonged to innocent individuals who had been hacked and repurposed for this scam. This could be easily understood by looking at the past photos and videos shared on the account.

For example, the Facebook profile named “Türkiye Gündemi” in the screenshot below, which impersonated the A News channel, revealed upon inspecting the “Mentions” page that the account originally belonged to a person named Nestor Soler and had been created in 2017.

Within six months, a significant number of people in Turkey were likely targeted by this fraud method, prompting both Baykar and Bosphorus Gaz companies to issue public warnings to inform the public.

Combatting Deepfake

In the cyber world where avoiding falling victim to scams orchestrated using the latest technological advancements becomes increasingly challenging each day, how can videos suspected to be deepfakes be detected by end-users, experts, and journalists?

When it comes to detecting the aforementioned deepfake videos, it can be said that they are relatively easier to detect compared to other types of deepfakes. It is observed that academic studies are rapidly ongoing in this regard, and technology giants like Intel are implementing technologies such as FakeCatcher to address this issue. However, as accessing these corporate-oriented technologies may sometimes be impossible for end-users, the need to verify suspicious images and videos encountered by those who follow news on social media or shop online (much like the need to verify information today) becomes increasingly important day by day.

When listening to experts and authorities about what to pay attention to in order to determine whether an image or video is deepfake, the following points generally stand out:

Blurring evident in the face but not elsewhere in the image or video (or vice-versa) A change of skin tone near the edge of the face Double chins, double eyebrows, or double edges to the face Whether the face gets blurry when it is partially obscured by a hand or another object Lower-quality sections throughout the same video Box-like shapes and cropped effects around the mouth, eyes, and neck Blinking (or lack thereof), movements that are not natural Changes in the background and/or lighting Contextual clues – Is the background scene consistent with the foreground and subject?

To find out if these recommendations really work, when the real video of Acun ILICALI, who is targeted by fraudsters, is compared side by side with the deepfake video, the first item in the list, “Blurring evident,” indeed stands out immediately.

Similarly, when close-up scenes are placed side by side and advanced simultaneously, inconsistencies, especially in mouth movements, facial expressions, and the visibility of teeth, also raise suspicion.

If you ask me if there are there any tools or applications that can detect these deepfake videos on your own system, I would recommend taking a look at the “Deepfake detection using Deep Learning” project.

For those who want to detect deepfake videos effortlessly and for free using multiple deepfake detection algorithms based on online and academic studies, I highly recommend the DeepFake-O-Meter application.

For instance, when I analyzed a deepfake video created by scammers using excerpts from Selçuk Bayraktar’s video on DeepFake-O-Meter, most of the algorithms clearly indicated that there were inconsistencies with this video, suggesting that I should be suspicious.

For those who want to detect such deepfake images and videos by just using a browser extension, the DeepfakeProof Chrome extension could be worth trying.

How Easy to Create a Deepfake Video?

Looking at the spreading of fake advertisements using deepfake videos over the past 6 months, it was evident that the process of creating these fake videos had to be excessively easy and low-cost or even free for fraudsters. To support this thesis, when I began researching applications that could potentially be used by fraudsters to create deepfake videos, the focus shifted immediately to the Wav2Lip model, mainly due to its blurriness, use of lip-sync techniques, and, of course, being open-source and free.

Wav2Lip is a free, open-source deep learning model that can lip-sync videos to any audio track with high accuracy. It works for any language, voice, or identity, including synthetic voices and CGI faces.

When I experimented with the Wav2Lip_simplified_v5.ipynb Jupyter notebook tool on one of the videos, targeted by fraudsters, the similarities with the deepfake video (the problem of lip movements not always being synchronized with the generated audio from the text (audio deepfake)) reinforced the possibility that fraudsters were utilizing this model.

Conclusion

The groundbreaking developments in artificial intelligence continue to grease the wheels for scammers, making their jobs easier. For instance, by simply paying a monthly fee of $5 and uploading a video or audio file of the person you want to mimic to the ElevenLabs web application, you can use artificial intelligence to have any text you write voiced by that person. With this situation in mind, such services always have the potential to be abused by malicious individuals.

In the face of increasing deepfake videos on social media and networks, let’s be very, very cautious, and similarly, let’s not forget the possibility of our voices being copied (audio deepfake) and being used against our loved ones by fraudsters. It might be beneficial to already establish a keyword to be used for verification purposes in emergencies with your loved ones against the possibility of your voice being copied.

In today’s world, where we can’t believe what we hear (audio deepfake), what we see (deepfake video), or what we read (misinformation, disinformation, deepfake text), let’s not forget the age-old advice: “Don’t believe anything you haven’t seen with your own eyes.”

Hope to see you in the following articles.

3

Information Thieves

Introduction

In recent years, when we look at cybersecurity incidents involving prominent entities such as Uber, Airbus, Grand Theft Auto VI, and similar cases, we observe that malicious software, specifically infostealers designed for information theft, has come to the forefront. These types of malware are increasingly playing infostealers a significant role in the cybercrime ecosystem.

Research indicates that in 2023, cybersecurity incidents related to this type of malicious software doubled compared to the year 2022. Particularly in Russian markets, there is a notable increase, with logs stolen and offered for sale by these malicious programs showing a 690% surge since 2021.

Reference: ANY.RUN

What is Information Stealer Malware?

Information stealer malware is a type of software that steals personal and financial information, including usernames and passwords related to applications and systems such as VPN, RDP, and SSH. Subsequently, this stolen information is sent to the malware’s developer. Often, these malicious programs are sold or leased by their developers as a malware-as-a-service (MaaS) model on a weekly or monthly basis to initial access brokers (IAB).

The information stolen by malware is later sold to threat actors, operators (customers), on underground forums, and Russian marketplaces (Russian Market) by initial access brokers (IAB), which are common meeting places for cybercriminals.

Reference: Secureworks

Particularly, cyber threat intelligence firms like SOCRadar closely monitor these places and warn their clients about the information offered for sale. Thanks to these alerts, enterprises can quickly identify and freeze the accounts of their employees, customers and suppliers, preventing the misuse of this information by cybercriminals. Otherwise, for example, a threat actor who plans to carry out a ransom attack on enterprise X can easily realize his evil ambitions with this access information purchased from the initial access broker for $10.

Reference: SOCRadar XTI

3-2-1 Action!

Our story begins on July 25, 2023, with a WhatsApp message from Bartu KILIÇ‘s relative. His relative, who is an insurance consultant, becomes suspicious when someone seeking to get car insurance sends a file (skoda__superb2013_1.6ti_ruhsat.rar) labeled as a registration through WhatsApp. Deciding to bring this matter to Bartu, who is a cybersecurity expert, the relative shares the details. Bartu, during a conversation about recent attempts of fraud, shares this story with me, sparking my interest. Subsequently, as I begin to investigate, events unfold around this intriguing topic.

Our story begins with a WhatsApp message from Bartu KILIÇ‘s relative on July 25, 2023. His relative, who is an insurance consultant, is suspicious of a file (skoda__superb2013_1.6ti_ruhsat.rar) sent to him via WhatsApp under the name of a registration by a person who wants to get car insurance and decides to bring the issue to Bartu, a cyber security expert. Bartu shared this story with me while we were chatting about recent fraud attempts, and events unfolded as I started to investigate this topic, which intrigued me very much.

Some time after I asked Bartu to ask his relative to review the file, he shared that the file had been deleted and therefore he was unable to obtain it. Since I had the scammer’s mobile phone number (+90 545 466 89 52), I decided to contact the threat actor via WhatsApp. Introducing myself as an employee of the insurance company’s headquarters (not only scammers or threat actors impersonate trusted officials, customer service representatives :)), I started to correspond with the threat actor and soon I was able to obtain the suspicious file that is the subject of the story.

Time Period 7/25/23, 13:34 – 7/26/23, 06:57 | Translation in English

Mert: Hello.
Mert: Our insurance agency couldn’t view your registration file. Could you resend it, please?
Threat Actor: Shall I send it from here?
Mert: If possible. I think there’s an issue with the PDF version at the agency; they requested support from us at the headquarters. Since I’m on WhatsApp desktop, I can open it easily from here.
Threat Actor: Alright, I’ll send it.
Threat Actor: Are you still at the computer?
Mert: Yes, sir. Our working hours end at midnight.
Threat Actor: Okay.
Threat Actor: I’ll send it in 10 minutes.
Mert: Alright.
Threat Actor: skoda__superb2013_1.6ti_ruhsat.rar (file attached)
skoda__superb2013_1.6ti_ruhsat.rar
Threat Actor: Here you go.
Mert: Unfortunately, we cannot receive calls from the corporate WhatsApp line.
Mert: I will check and provide information.
Threat Actor: Alright, I’ll be waiting.
Threat Actor: What’s the status?
Mert: I couldn’t run it on my Mac; unfortunately, I asked for help from the support team.
Threat Actor: What’s the error when opening it?
Threat Actor: ?
Mert: It opens with an application called TextEdit; codes are displayed on the screen instead of a PDF.
Threat Actor: Alright.
Threat Actor: If you try on Windows, it will be more reliable, I think.
Mert: Alright, I’ll drop this note into the support team ticket. Thank you for your understanding.
Threat Actor: Alright, thank you.
Threat Actor: I need to get a quote today or tomorrow.
Mert: The issue will be resolved by the end of business hours tomorrow.
Threat Actor: I think it works on a Windows operating system.
Mert: As the headquarters team, we only use Mac computers. I also asked my colleague, but unfortunately, he couldn’t open it either.
Mert: Since there’s no one on duty at the support team, our ticket can only be answered after 9:00 in the morning.
Threat Actor: Did it work on Windows, by any chance?
Threat Actor: I wonder.
Mert: Unfortunately not. All teams use Mac computers.
Threat Actor: Is there anyway to run it on Windows tomorrow?
Mert: In the support team, there are both Windows and Mac computers, so I think it will be resolved.
Mert: If I can open your registraton file in another way, I’ll send it that way.
Threat Actor: Alright, I’ll wait for tomorrow 😭
Threat Actor: I’m out of town.
Mert: At the moment, I can’t help in any other way.
Threat Actor: I can wait for tomorrow.
Threat Actor: No problem.
Mert: Thank you for your understanding.
Threat Actor: Thank you.
Threat Actor: Have a good day.
Mert: Good evening.
Threat Actor: Hello.
Threat Actor: Good day.
Threat Actor: What’s the status?
Mert: Sir, I was about to write to you as well. My colleagues are encountering an error, something about a “powershell error.” Could you send another copy of the registration file?
Threat Actor: Have you tried it on Windows?
Threat Actor: Maybe.
Mert: Yes, I just checked, and it’s noted as “Windows 10 Enterprise” in the ticket.

Static Suspicious File Analysis (44.exe)

After opening the “skoda__superb2013_1.6ti_ruhsat.rar” file on a virtual Windows 11 operating system, I immediately noticed the “skoda__superb2013_1.6ti_ruhsat.bat” file. When I opened the file with Notepad, a character string encoded in UTF-16 appeared. Upon examining the BAT file with the HxD hex editor, I observed that the threat actor utilized the byte-order mark (BOM) method to prevent the disclosure of commands with text editors.

When I examined the commands hidden behind this encoding, I observed that, when the BAT file is executed, it first utilizes PowerShell commands to add the C: directory to the exception list of Microsoft Defender, preventing the detection of this malicious software by Microsoft Defender. Subsequently, it downloads and executes a file named 44.exe from the instant messaging and VoIP social platform Discord.

Dynamic Suspicious File Analysis (44.exe)

Up to this point, setting aside this BAT file, which has been clearly designed for highly suspicious operations, I decided to download the file named 44.exe, upload it to the interactive malware analysis platform called ANY.RUN, run it, and examine the logs.

When I looked at the logs created on the operating system by the 44.exe process, the significant ones include:

It was retrieving the geographical location information and basic ASN details of the IP address of the system it was executed through IPinfo. It was obtaining the available Gofile server information to upload the stolen files from the operating system to the Gofile file-sharing platform. The stolen files were uploaded to the Gofile platform, and it was obtaining the shareable download link. The download link was being sent to the developer of the malware. (http://antonybarlett[.]site:2095/stats). The download link address was being sent to the Discord channel of the threat actor through a Webhook.

When examining the fifth entry, I noticed the InvictaStealer tag in the HTTP request and the Telegram address https://t.me/invicta_stealer. Upon visiting the Telegram channel, it became clear that this software is an information-stealing malware (infostealer) of Russian origin, developed in the C++ programming language. The builder for this malware was freely available on the GitHub storage platform.

One or more interactive elements has been excluded from this version of the text. You can view them online here: https://pressbooks.pub/mertrix/?p=71#oembed-1

*Invicta Stealer’s promotional video on its YouTube channel*

Dynamic Malicious File Analysis (Builder.exe)

I downloaded the InvictaStealer Builder.zip file from the GitHub repository belonging to the malware developer and began examining it by running it on my virtual system. When the application is opened, it prompts the user to enter a Discord Webhook or a URL, and upon pressing the Build button, it builds the malicious software. For testing purposes, I entered AAAAAA… in the Webhook/Server URL section and successfully created the malicious software.

When I uploaded the malicious software to ANY.RUN to discover similarities with 44.exe, I noticed a commonality in both pieces of software, which is the web address http://antonybarlett[.]site:2095/stats. When I searched this address on the VirusTotal malicious software analysis platform, I found that it was flagged as suspicious by only SOCRadar and marked as unwanted (spam) by Fortinet among security vendors.

This web address is common to two different malware samples, which I’m sure doesn’t surprise me and the readers of my article “Was Turkey’s e-Government Hacked?” because in that article we saw that threat actors often embed backdoors in the files they share. In this malware, the developers didn’t neglect to ensure they also receive the addresses of files stolen and uploaded to the Gofile file-sharing platform. 🙂

Threat Actor Targeting the Insurance Consultant – Who is it?

After obtaining this information, it was time to find answers to the crucial questions that had been lingering in my mind. Who was the threat actor that downloaded and created this malicious software from the GitHub repository, targeting the insurance consultant? To answer this, I decided to leverage the Discord Webhook address embedded in the malicious software. When I visited this address, the Discord API revealed that the user who created this Webhook, with the username Nedimtac, joined Discord on June 17, 2023. The individual displayed as “İplikçi Nedim” in the display name.

The username of this person was “iplikkkk” in July 2023, and after changing the display name to “SANALIN FATİHİ” in August, the account was completely deleted in September. Although I tried to contact this person, unfortunately, I couldn’t have the chance to chat with him as he did not accept my invitation.

Why Might an Insurance Consultant/Agency Be Targeted?

It was time to find an answer to another question. How could the threat actor have found and obtained the mobile phone number of the insurance consultant? In recent years, with a wealth of information circulating in the hands of cyber criminals, it might not be too difficult to guess who has access to our mobile phone information. However, I decided to delve a bit more into this particular issue.

When it comes to the insurance consultant, just like real estate agents, their mobile phone information should be easily findable and reachable on the internet, in publicly accessible places. If this threat actor is targeting insurance agents, then one would assume their first stop could be the Google search engine. Could they easily obtain this information from there?”

For this, when I searched with the keyword “insurance agency” on the Google search engine, I observed that there were numerous insurance agencies sharing their mobile phone information. Seeing that threat actors targeting insurance consultants and agencies could potentially exploit systems they hacked using this method and, through those systems, gain access to the internal systems of insurance companies, it was more than enough to deeply concern me.

Conclusion

When I thought about why insurance consultants and agencies are targeted by threat actors with information-stealing malware, I thought of the high potential of converting this information into query panels and/or selling it to fraudsters or threat actors, as in my article “Was Turkey’s e-Government Hacked?“. Whether this possibility is low or high, the undeniable truth of today is that threat actors target our personal data and the organizations that have access.

In conclusion, regardless of the likelihood, it is crucial for everyone to think twice before clicking on links or opening files from unknown sources.

Hope to see you in the following articles.

4

Investment Scammers

Introduction

If you remember, in the article I published in June 2024 titled Deepfake Scammers, I mentioned that I would provide the technical details of their operations to be covered in another article.

Since then, the information I have obtained through cybersecurity research has reached a point where I struggled for a while to decide which parts to write about. Ultimately, I decided to focus on the sections that I believe would be most beneficial for raising awareness, including the phone conversations I had with the scammers.

I hope this 200th research article, which also represents an important milestone for me, achieves the level of awareness I aim for. Even the smallest piece of information revealed through this research could contribute to illuminating fraud cases and be beneficial to a wide range of people, from victims to law enforcement.

Please don’t forget to share this article with those around you to help raise awareness and reduce the number of people falling victim to such scams.

Technical Research

Discovery

In March 2024, the domain name tr-billgi[.]com, added to the list of Malware URLs by TR-CERT (Computer Emergency Response Team of the Republic of Türkiye) with the description Financial Phishing, caught my attention.

When I visited the website, the page I encountered appeared quite ordinary and harmless. Assuming that this page might be a fake homepage (cloaking), commonly used by threat actors to hide the actual phishing page, I decided to investigate the site further. And that’s how my story began.

Investment Scammers
Translation:

“Discover the World of Possibilities with GlobalChange”
“With us, you will be able to explore new ideas, breaking news, and apply changes that will shape the future.””

Button: “Learn More”
Investment Scammers

Detection of Malicious Content

When I examined the tr-billgi[.]com website a bit further, the /thanks directory caught my attention. Upon visiting this page, I started to suspect that it was where users who filled out any form on the site were redirected. The page prominently featured repeated phrases like “Don’t miss any calls” and “Our manager will contact you shortly”, indicating that those who filled out the form were being contacted by someone.

Translation:

Queue Position: 8
“Stay in touch! We will contact you shortly.”
“Due to the high number of people interested in joining the platform, all new users are currently on a waiting” list.
“Do not miss any calls within the next few hours; otherwise, your spot will be given to someone else.”
“Your request has been successfully submitted. Stay in touch with us, and our manager will call you shortly.”

As I continued to explore this website, I discovered that this threat actor, like those featured in another of my research articles, had made errors in Operations Security (OPSEC). Taking advantage of this mistake, I gained access to the website’s source code and began examining the code piece by piece.

In a short time, I found the fake homepage’s code within the general.php file. Upon reviewing the index.php file in the Thanks directory, as well as the offer.php and index.html files in the page folder, I uncovered that the phishing site was designed by the threat actors to abuse the name of the Baykar defense company. They used this setup to lure victims with promises of investment opportunities.

The presence of Italian texts alongside Turkish ones on the phishing page caught my attention. From my previous article, Deepfake Scammers, I knew that these threat actors often abuse the names of international organizations (e.g., Slovnaft, INA d.d, Bosphorus Gaz, Baykar, Interpol) for their scams. This suggested that the Italian text likely originated from a phishing site they created to target an Italian company, but they had forgotten to translate it into Turkish.

Translation:

Header (in Italian):
“BAYKAR Investment – Join us and earn passive profits through the company’s sales and growth.”

Registration Form (in Turkish):

Countdown Timer: “Early free registration ends in: 12:21:18”
Labels:
Name
Surname
Email (example@gmail.com)
Phone Number (with country code)
Button:
“Create a free account”

Technical Surveillance

Additionally, while examining the index.php file in the thanks directory, I uncovered a critical piece of information that deepened my investigation: the Telegram Bot API token belonging to the threat actors.

In recent years, the Telegram messaging application has become a haven for criminal organizations, threat actors, and scammers due to its speed, security, and file-sharing capabilities.

Many threat actors use the Telegram Bot API to monitor the stolen information of victims through Telegram bots and channels they create. To achieve this, their first step is embedding their bot tokens into the source code of their phishing sites.

Because these threat actors do not anticipate that the source code of their phishing sites will be accessed by others, they often leave these tokens unchanged for months. This oversight allows law enforcement and cybersecurity researchers to monitor the threat actors’ activities on Telegram.

By March 2024, I had begun scrutinizing all messages sent via the Telegram bot associated with this token. I discovered that this token was used across multiple phishing sites. The forms filled out by victims on these phishing sites provided data such as their names, phone numbers, email addresses, IP addresses, the specific phishing site they visited, and the country they were located in. This information was transmitted to the Telegram channel in real time.

When I examined the profiles of the users in the Telegram channel and their conversations, I struggled to determine whether they were Russian or Ukrainian. To resolve this, I decided to rely on the Deepl translation tool, which identified all the texts as being in Russian.

However, I couldn’t definitively determine whether these users were the actual operators who created and ran the phishing sites or merely administrators of a third-party service providing Telegram bot infrastructure to the threat actors. This part of the investigation remained uncertain.

By July 2024, after closely monitoring the phishing websites used by scammers, I began entering my phone number into the forms on these websites to establish communication with the scammers.

Investment Scammers
Translation:

Question 1:
“Your age?”

Under 18
18–25
26–45 (selected)
46–60
Over 60

Question 2:
“Do you fall into any of the following categories?”

Retired (selected)
Disabled person
A family with three or more children
No

Question 3:
“For what purposes do you want to earn passive income?”

To buy a new house/car
To create a large financial “cushion”
To start a business
Investment Scammers
Translation:

Question 3 (continued):
“For what purposes do you want to earn passive income?”

To buy a new house/car (selected)
To create a large financial “cushion”
To start a business
To pay off debts
To meet your family’s needs
To protect yourself against inflation and devaluation
Others

Question 4:
“Do you have any experience in making investments?”

Yes
No (selected)
Only in cryptocurrencies

Question 5:
“How much passive income do you plan to earn to achieve your goals?”

Investment Scammers
Translation:

Question 6:
“How much passive income do you plan to earn to achieve your goals?”

5000₺
10000₺
15000₺
25000₺ (selected)

Message after selection:
“Thank you for completing the survey! From now on, you are officially a member of Baykar. Personalized access to your account and key points of the project will be provided to you by the project operator. You will be contacted within one day. Good luck!”

Form Section: “Fill out the form”

Name: Osman
Surname: [hidden]
Phone Number: +90 (533) [hidden]

Button: “Submit”

Investment Scammers
Translation:

“Thank you. Your application has been accepted.”
“Your consultant will get back to you as soon as possible. Do not miss the consultant’s call.”

Button: “Go back to the start”

1. Fraud Attempt

On July 22, 2024, I received a WhatsApp message from the phone number +90 539 100 81 28, sent by someone named Derin, who introduced themselves as a customer consultant. The message was in response to the form I had filled out.

*Click here to see the untranslated version*

Since I live in the United States and there’s a 7-hour time difference with Turkey, communicating with the scammer was sometimes challenging. Especially since the scammer worked from 9 AM to 6 PM Turkish time (a “profession” that doesn’t involve overtime. 😊) and preferred to contact me in the morning, most of our interactions took place after 2 AM my time. However, since my goal was to uncover this fraudulent scheme, I managed to answer all their calls with great motivation, even in the dead of night.

During my WhatsApp conversation with the scammer on July 23, 2024, they stated that I needed to install an application on my mobile device to conduct stock trading. For this, they directed me to visit the web address https://appzone[.]mastercapital[.]info/#/auth/login

Although the scammer referred to it as a mobile app, I realized that it was, in fact, a Progressive Web Apps (PWA)—a type of web-based application.

Investment Scammers
*Click here to see the untranslated version*
Investment Scammers
Investment Scammers

When I logged into the web application, the interface strongly resembled the fake exchange I had covered in my article titled Exposing Pig Butchering Scam. The difference was that the scammers had added a fake Baykar stock symbol (BAYKR-IST) to the list of symbols available in the application.

As the conversation progressed, the scammer informed me that to transfer funds to this exchange and supposedly purchase Baykar shares, I would need to send money to the bank accounts they provided.

Since my primary goal was to understand the scammers’ methods and, as I did in my article WhatsApp Scammers, identify the misused bank account details to share with bank officials, I decided to create a scenario to uncover more information.

I made an effort to ensure the scenario was long and realistic because I knew that every minute they spent with me was time taken away from scamming innocent people.

After enthusiastically taking on the role of a victim trying to make a money transfer but constantly encountering errors, I told the scammer that I was receiving errors. After some time, the scammer shared new bank account details with me. I promptly shared the information I obtained with the bank authorities.

Investment Scammers
*Click here to see the untranslated version*
Investment Scammers
*Click here to see the untranslated version*
Investment Scammers
*Click here to see the untranslated version*

Frustrated by the errors I encountered, the scammer named Derin quickly directed me to another scammer named Demir (+90 539 105 14 31), who seemed much more knowledgeable and experienced with bank internet/mobile banking screens. However, luck was not on their side.

IP Detection

As the conversation progressed, I decided to use the Grabify IP Logger application to learn the IP address of the scammer who was communicating with me via WhatsApp.

On Grabify, I created a link that redirected to a SIM card block removal page of a bank when visited. I then shared this link with the scammer. By timing the sharing of the link according to the flow of the conversation, I was able to quickly identify the scammer’s IP address and the city they were connecting from via Grabify. (93.182.105.132 – Mersin)

Investment Scammers
*Click here to see the untranslated version*
Investment Scammers
*Click here to see the untranslated version*
Investment Scammers

After obtaining the information I wanted, I decided to continue with a scenario where I played the role of a victim who had already been scammed by another scammer, aiming to give the fraudsters a “cold shower” experience. As a result of the messages I crafted, the scammers, thinking they had fallen victim to competition against another scammer, started sending me a series of complaint-filled messages one after another.

Investment Scammers
*Click here to see the untranslated version*
Investment Scammers
*Click here to see the untranslated version*
Investment Scammers
*Click here to see the untranslated version*

Despite my messages, the heartless and cold-blooded scammers, who clung to their hopes of scamming me a second time and were motivated to keep the communication going, eventually stopped messaging after I stopped responding for a while.

*Click here to see the untranslated version*

Amidst all these events, Baykar has continued to issue warnings to the public through written, visual, and social media platforms since the beginning of 2024, tirelessly sharing alerts (#1, #2, #3) to raise awareness.

Audio Recordings

For those curious, you can listen to the mind-boggling conversations (unfortunately it is in Turkish) I had with the scammers through the audio recordings available below on my YouTube channel.

2. Fraud Attempt

IP Detection

In October 2024, nearly three months after the previous fraud attempt, another scammer named Ipek contacted me using the same scheme, this time from the phone number +90 548 822 66 82. Seizing the opportunity, I decided to use the same method as before to obtain this scammer’s IP address.

After baiting the scammer in a similar manner, I discovered that, unlike the previous one who was connecting from Mersin, this scammer was connecting from Tbilisi, the capital of Georgia. (I assumed the scammer was not using a proxy server.)

Investment Scammers
*Click here to see the untranslated version*
Investment Scammers

Curious about whether the main actors from the previous fraud attempt, Derin or Demir, were still active in their operations, I persistently told this scammer that I would only deal with Derin or Demir. Succumbing to my insistence, the scammer decided to contact Derin and redirect me to them. Through this, I discovered that the scammers had been continuing their operations at full speed with the same team over the past three months.

*Click here to see the untranslated version*

Conclusion

As a result of this security investigation, I uncovered how an international fraud ring uses the names of prominent institutions—ranging from oil refineries and gas distribution companies like Slovnaft, INA d.d, and Bosphorus Gaz, to defense companies like Baykar, and even Interpol—to deceive and ensnare their victims. I sincerely hope that these scammers, who prey on the money of innocent citizens, are caught and brought to justice as soon as possible.

As I mentioned at the beginning of this piece, I earnestly request you to share this article with your loved ones and everyone around you to prevent more innocent people from falling victim to this well-orchestrated scheme of organized fraud.

Taking this opportunity, I would also like to wish you a Happy New Year. May 2025 bring you and your loved ones health, happiness, and success!