Using the new scheme, fraudsters plan to steal money and passport data, gain access to accounts on social networks and electronic mailboxes of Russians who needed to issue passes during the quarantine period. At the moment, criminals are working on creating clones of government agencies responsible for issuing documents (including mos.ru, mosreg.ru and gosuslugi.ru), and fake media portals on which it is planned to post fake news, experts told Izvestia on cybersecurity. In addition, the planned hackers and the mass mailing of messages via e-mail, social networks and instant messengers. To protect against intruders, experts advise using information verification services. About how to do this - in the material of Izvestia.

Clone attack

Forced isolation due to the COVID-19 pandemic is forcing people to spend more and more time on the Internet. The network is needed for working remotely, studying, ordering goods and organizing home leisure activities. The growth of traffic was even confirmed by the deputy head of the Ministry of Communications Alexey Volin, who said that "when they stayed at home, the people rushed to the Internet, and rushed there with terrible force."

According to the Russian company "Internet Rozysk", network scammers also decided to take advantage of the trend. Now they are organizing a global criminal system consisting of fake sites, hacked accounts on social networks and malicious Telegram bots. Criminals are going to attract people with a service to provide passes for moving around the city in the context of the COVID-19 epidemic, and then steal their money and personal data.

“We got information about the upcoming action using our bots, which are embedded in the darknet (the shadow segment of the Internet. - Izvestia) and a number of closed chats,” said Igor Bederov, CEO of the company. “We learned from them that a scheme is being prepared for deceiving people who plan to obtain passes for themselves.”

According to the expert, this scheme, known as the “rabbit hole”, involves the mass mailing of addresses of fake sites that will be as similar as possible to the resources of government agencies with the authority to issue documents (including mos.ru, mosreg.ru and gosuslugi.ru ) It is expected that this will happen with the help of hacked accounts on social networks and Telegram bots. Attackers will try to confirm the legitimacy of the messages with links to articles allegedly posted in leading Russian media - their sites will also receive clones.

Throughput pressure

After users switch to malicious resources, they will be asked for passport data for issuing passes, as well as bank card details - supposedly to pay for the service upon receipt.

“Their further actions can be predicted from earlier criminal actions of this type, which, in particular, were conducted under the guise of receiving certain compensatory state payments or paid bank surveys,” warned Igor Bederov. - Then the criminals, as a rule, sought a voluntary transfer of money, after which they managed to withdraw the remaining funds from the cards with the help of the details already received.

At the same time, personal data of users is likely to become goods for sale on the black market, forming new illegal bases. The final stage of the scheme is usually the hacking of the personal accounts of the deceived user on social networks and his mailboxes (this is done using the captured cookies), after which they are connected to the distribution of malicious messages.

The large-scale nature of the illegal action was confirmed by specialists of the Security Intelligence Cryptocurrencies Platform (SICP) risk analysis service.

“The scale of the new threat is comparable to the financial pyramids, the organizers of which spend huge sums on promotion through famous people and popular sites,” said Aleksandr Podobnykh, an independent expert at SICP. - And the state’s symmetric response to this, I’m afraid, can only be a significant increase in control over SIM cards, hosting and data centers.

According to experts, in addition to the already mentioned increase in Russian Internet traffic, there are a number of additional factors that will play into the hands of criminals, increasing their chances of success.

“First of all, they include neurotization of people against the background of the epidemic, which makes it easier to manipulate,” said Luka Safonov, director of the information security department of the National Engineering Corporation. - On the other hand, the situation is complicated by the situation with state portals, which now do not withstand the influx of visitors. The fact is that when people cannot get a pass through an official resource, they are most likely to be interested in an alternative offer.

Simple calculations

Despite the sophistication of criminal methods, you can still protect yourself from fraud using a few simple tools that allow you to calculate fraudsters. The instruction for checking incoming messages to Izvestia was provided by Internet Rozysk:

- all state organizations and private companies operating in Russia have domain names registered in our country. Therefore, suspicious links should be checked through the WHOIS service, which reveals their true owners. If, according to the results of the examination, they turn out to be hidden, then it is better not to trust the received information.

- checking the sender of the letter, which can be carried out through the verifiers of mailboxes located on the sites https://2ip.ru/mail-checker/, will be useful in such a situation; http://ru.smart-ip.net/check-email/ and https://ivit.pro/services/email-valid/. It will make sure that the message came from the server of the organization whose employees were indicated as its authors.

- also an indirect sign of fraud can be the so-called shortened link, which has the end click.ru, goo-gl.ru, etc. Its original address is also worth checking (without going to it!) Using special services - they are available at: https://scanurl.net/; https://vms.drweb.ru/online/, https://virusdesk.kaspersky.ru/ and https://iplogger.ru/url-checker/.

The Izvestia source in the power structure confirmed the need for additional verification of the legitimacy of the request when receiving a request for the transfer of funds. “This needs to be done even if it seems that the message was sent to one of the state structures,” he noted.

The expert also proposed an additional way to check emails received via e-mail: you should try to reply to a suspicious message. If the address of the organization’s employee does not change, then with a high degree of probability it is not fake.

However, this does not eliminate the need for additional checks described in the instructions.

Roskomnadzor responded to a request from Izvestia that they were ready to promptly send administrators of sites hosting false information notifications of the need to delete it, if the Prosecutor General's Office so requires.

“If this instruction is not followed, information will be communicated to telecom operators about the need to limit the access of Russian users to this content,” the organization noted.

At the same time, Roskomnadzor emphasized that they do not have the authority to conduct investigations to prevent cybercrime and fraud on the Internet.

Izvestia also sent inquiries to the Ministry of Internal Affairs, the FSS and the Moscow Department of Information Technology. However, operational responses could not be obtained.

Source: IZ.ru

On September 3, 2019, in St. Petersburg, specialists and residents of the SafeNet RIC of the St. Petersburg Technopark, together with the Russoft NP and Bee Pitron, held a presentation session for the Indian delegation of Infinity Group. The key focus of the event was the creation of a platform for interaction between participants in the Russian-Indian market.

As part of the meeting, Igor Bederov presented the developments of the Special Development Department for a distinguished guest from India. Mr. Darbari drew particular attention to existing developments in the field of cryptocurrency transaction control and crime prevention. According to him, in India, up to 20% of the population and a significant amount of low-level crime use cryptocurrencies. In addition, the country has not resolved the problem of relapse in previously convicted criminals.

Back in July, in the format of the Second Russian-Indian strategic dialogue, in order to establish a technology transfer, an agreement was signed between RUSSOFT and Infinity Group. As a result, the ICT Center of Excellence project was launched in India, designed to establish cooperation between the two countries in the direction of business development and international assistance to SMEs.

The delegation of the Infinity Group, headed by Mr. Darbari, flew to Russia to meet with potential recipients of investments and to transfer technology from Russia to India under the “Made in India” program.

After a tour of the engineering center, SafeNet residents presented their projects in the areas of Artificial Intelligence, Internet of Things, cyberphysical security, blockchain, virtual and augmented reality. The parties discussed the situation on the international high-tech market and considered options for potential mutually beneficial cooperation. ICT experts emphasized the relevance of Russian solutions to the market of India and other countries and discussed the possibility of implementation.

Source: Engineering center SafeNet.