In July 2024, cybersecurity provider KnowBe4 began observing suspicious activity related to a new employee who started manipulating and transferring potentially harmful files and attempted to run unauthorized software. It was later discovered that he was a North Korean worker who had deceived the company’s human resources team to obtain a remote job. In total, he managed to pass four video conference interviews, as well as a pre-employment background check.

ESET, a leading company in proactive threat detection, analyzes and delves into this scam and warns that no organization is immune to the risk of inadvertently hiring a saboteur.

“Identity-based threats are not limited to password theft or account takeover, but extend to new hires. As AI becomes more adept at falsifying reality, it becomes essential to refine and optimize hiring processes” warns Camilo Gutiérrez Amaya, Head of the ESET Latin America Research Lab.

This type of threat has been present since at least April 2017, according to an FBI alert and tracked as WageMole by ESET Research. According to Microsoft, the US government has discovered more than 300 companies—some of them Fortune 500—that have fallen victim to these types of attacks between 2020 and 2022. The tech giant was forced in June to suspend 3,000 Outlook and Hotmail accounts created by North Korean job applicants.

Furthermore, a US indictment accuses two North Koreans and three “facilitators” of obtaining more than $860,000 from 10 of the more than 60 companies where they worked. ESET’s research team warns that the focus has recently shifted to Europe, including France, Poland, and Ukraine. Google, for its part, has warned that British companies are also being targeted.

Identity theft scams

These scams are possible because fraudsters create or steal identities that match the location of the target organization and then open email accounts, social media profiles, and fake accounts on developer platforms like GitHub to add legitimacy. During the hiring process, they may use deepfake images and videos, or face-swapping and voice-changing software, to disguise their identity or create synthetic ones.

According to ESET researchers, the WageMole group is linked to another North Korean campaign they track as DeceptiveDevelopment. This campaign focuses on tricking Western developers into applying for nonexistent jobs. The scammers ask their victims to participate in a coding challenge or a pre-interview task. But the project they download to participate actually contains Trojanized code. WageMole steals these developer identities to use in their fake employee schemes.

The key to the scam lies with the foreign facilitators

• Creating accounts on freelance websites
• Opening bank accounts, or lending the North Korean worker their own
• Purchasing mobile phone numbers or SIM cards
• Validating the worker’s fraudulent identity during the employment verification process, using background check services. Once the fake worker is hired, these individuals receive the company laptop and install it on a laptop farm located in the hiring company’s country. The North Korean IT worker then uses VPNs, proxy services, remote monitoring and management (RMM), and/or virtual private servers (VPS) to conceal their true location.

“The impact on deceived organizations could be enormous. Not only are they unwittingly paying workers from a heavily sanctioned country, but these same employees often gain privileged access to critical systems. It’s an open invitation to steal confidential data or even demand a ransom from the company” emphasizes the ESET researcher.

In terms of detection and protection, ESET explains how to prevent an organization from becoming a victim

1. Identify fake employees during the hiring process:

• Check the candidate’s digital profile, including social media and other online accounts, for similarities with other people whose identities they may have stolen. They may also create multiple fake profiles to apply for jobs under different names.

• Pay attention to discrepancies between online activity and declared experience: a “senior developer” with generic code repositories or recently created accounts should raise red flags.
• Ensure they have a legitimate and unique phone number, and check that their resume is consistent. Verify that the companies mentioned actually exist. Contact references directly (phone/video call) and pay close attention to employees of staffing agencies.

Since many applicants may use fabricated audio, video, and images, insist on video interviews and conduct them multiple times during the hiring process.

During interviews, consider any claim that the camera is malfunctioning a major red flag. Ask the candidate to turn off background filters to increase the chances of identifying deepfakes (signs might include visual glitches, facial expressions that appear stiff and unnatural, and lip movements that are not synchronized with the audio). Ask questions based on the location and culture of where they “live” or “work,” for example, about local food or sports.

2. Monitor employees for potentially suspicious activity:

• Be on the lookout for red flags such as Chinese phone numbers, the immediate download of RMM software on a newly issued laptop, and work performed outside of normal office hours. If the laptop authenticates from Chinese or Russian IP addresses, this should also be investigated.
• Monitor employee behavior and system access patterns, such as unusual logins, large file transfers, or changes in work schedules. Focus on the context, not just the alerts: the difference between a mistake and malicious activity can lie in the intent.
• Use insider threat detection tools to identify anomalous activity.

3. Contain the threat:

• If a North Korean worker is believed to have been identified within the organization, proceed cautiously at first to avoid alerting them.
• Restrict their access to sensitive resources and review their network activity, limiting this task to a small group of trusted individuals from the IT security, human resources, and legal departments.

Preserve evidence and report the incident to law enforcement, while also seeking legal counsel for the company. “Furthermore, it’s a good idea to update cybersecurity training programs. And ensure that all employees, especially IT recruiters and HR staff, understand some of the warning signs to watch out for in the future. Threat actors’ tactics, techniques, and procedures (TTPs) are constantly evolving, so this advice will also need to be updated periodically. The best methods for preventing fake candidates from becoming malicious informants combine human expertise and technical controls. Make sure you cover all the bases,” suggests Gutiérrez Amaya of ESET.

ESET invites you to learn more about cybersecurity by visiting: https://www.welivesecurity.com/es/.

For other useful preventative information, also available in Venezuela: https://www.eset.com/ve/, and on their social media channels @eset_ve. Also on Instagram (@esetla) and Facebook (ESET).

With information and reference image provided by ESET and Comstat Rowland

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada How to detect fake job applicants: corporate espionage with malicious informants apareció primero en Bitfinance.

Brazil has marked a milestone in the judicial system by finding three citizens guilty of cryptocurrency fraud through a Ponzi scheme, which affected approximately seven thousand investors and amounted to $190 million.

Federal judge José Guimarães sentenced those involved: Antônio Inácio da Silva Neto, Luiz Carlos de Souza, and Fabrícia Campos Silva. The citizens are “linked to the company Braiscompany, which promised returns of up to 15 % per month thanks to alleged automated trading software.”

The sentence amounts to a total of 170 years in prison for those involved, in addition to the obligation to “repair the economic damages caused and seize assets acquired with illicit funds.”

The ruling by the Brazilian judicial system sets a precedent throughout the region, as it is the most severe known related to the cryptocurrency ecosystem.

M.Pino

Source: cripto247

(Reference image source: Kanchanara on Unsplash)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada Brazil hands down the largest sentence for cryptocurrency fraud apareció primero en Bitfinance.

Elon Musk, owner of the social network X, recently pointed out during the X Takeover event that he does not promote cryptocurrencies, and that any project on the subject that involves his name on social networks is a scam.

Musk indicated that he certainly sees great potential in Bitcoin, but that he does not promote cryptocurrencies or projects in this market. He reiterated that he was a fan of memes and hence his predilection for Dogecoin.

However, his constant promotion of this memecoin has generated controversy, as it has been considered market manipulation. Musk’s lawyers have come forward to address these accusations, denying his involvement in “pump and dump schemes for Dogecoin,” noting that “there is nothing illegal about tweeting supportive words or funny images about a legitimate cryptocurrency.”

The owner of Tesla indicated that people should be cautious when participating in a cryptocurrency project; verify that it is indeed a verified business.

Spambots and fake accounts that promote cryptocurrencies on the networks continue to increase, attracting victims who seek to enter the market. Musk’s warning goes beyond the use of his image or any connection with him with cryptocurrencies and emphasizes that it is the authorities who must implement the necessary mechanisms to prevent fraud, hacking and theft of assets.

M.Pino

(Reference image source: Shubham Dhage in Unsplash)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Elon Musk warns that crypto projects on social networks with his image are scams apareció primero en Bitfinance.

Users in Colombia of the Solain cryptocurrency buying and selling platform have reported blocks when trying to withdraw their assets. They suspect that they have been victims of a scam.

According to a report by the RedMas media, the Solain platform promised dividends between 2 and 3 % daily. However, this week in the town of Salento, Quindio, the alarm was raised.

Solain is preventing clients from trading cryptocurrencies, they have also not received the promised profits. It is an average of 2,000 people who have been waiting for the dividends on the first of July.

The reports indicate that “the platform would be requesting the investment of more money, so that people can withdraw their savings.” This makes us suspect a scam under the pyramid model.

Meanwhile, the Solain website displays the message to users that “in order to allow more members enough time to activate their accounts, they will extend the activation deadline from July 5 to July 10 at 23:59”. As if that were not enough, Solain customers also “must complete the top-up in accordance with the minimum conditions for activating the account balance.”

The platform asks them to verify the client’s real name, change the withdrawal password, link to their smartphone, and wait for the account to be activated.

M.Pino

Source: beincrypto

(Reference image source: Maliha Mannan, Unsplash)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Crypto platform users in Colombia denounce scam apareció primero en Bitfinance.

A group of researchers analyzed a new attack called “Pig Buchering”, which consists of encouraging victims to invest in cryptocurrencies once they have earned their trust using the same strategy as in love scams.

The Romance Scam or love scam is a social engineering attack that consists of tricking another person into believing that there is a love relationship between them online. To do this, the attacker creates a fake profile by stealing photos of other real people and, once he knows that the victim thinks he has fallen in love with her, they convince him to make bank transfers.

The main difference between the Romance Scam and the Pig Buchering, which translates as Slaughter of pigs, is that, in the second case, the scammers abuse the trust of the victims so that they invest in cryptocurrencies.

Of Chinese origin, this online crime has managed to position itself as one of the main social engineering attacks in non-English speaking countries. So much so that the United States Federal Bureau of Investigation (FBI) published a notice last April indicating that it was becoming increasingly popular.

In fact, according to data collected by the Global Anti-Scam Organization (GASO), victims lose an average of $122,000 with these frauds. In addition, two thirds of those affected are women between the ages of 25 and 44.

K. Tovar

Click the link to subscribe for free to our news and media group on Telegram: https://t.me/G_ELSUMARIO_News

Source: El Financiero

La entrada Pig Buchering, new cryptocurrency scam apareció primero en Bitfinance.

The British Army’s Twitter and YouTube accounts were hacked by a group of cybercriminals who have used them to promote a scam related to the cryptocurrency market.

In recent years, these types of fraudulent attacks linked to cryptocurrencies have been increasing as these assets have established themselves as a more widespread means of payment on the Internet.

In this context and on many occasions, cybercriminals target organizations and institutions that act with presumed legality as a spokesperson for their fraudulent operations.

This has been the case of the Twitter and YouTube accounts of the British Army, as indicated by the press department of its Ministry of Defense on the social network.

From this organization, they confirmed that they are aware of the violation of their accounts by the scammers and pointed out that there is “an ongoing investigation”.

Furthermore, from this account, the malicious actors retweeted several posts that allegedly gave away these NFTs and had placed a pinned tweet at the top of the wall that included a link to a fake website to mint these types of assets.

The cybercriminals also attacked the YouTube channel of the British Army and deleted all its videos, even changing both its profile picture and its name to that of the asset manager Ark Invest.

K. Tovar

Click the link to subscribe for free to our news and media group on Telegram: https://t.me/G_ELSUMARIO_News

Source: SPORT

La entrada British Army was hacked by crypto scam apareció primero en Bitfinance.

This security solutions provider announced that these fraudulent attacks share similarities with those registered a few months ago with another well-known brand such as Amazon.

In this threat, cybercriminals send a seemingly legitimate PayPal order confirmation, telling users that they have purchased more than $500 worth of the DogeCoin blockchain-based cryptocurrency.

To cancel the order, users have the option of calling a customer service or support number, a fake phone with which they contact cybercriminals.

From Avanan they report that the contact number that appears in these fraudulent emails is based in Hawaii (United States) and has previously been linked to other scams.

In addition to gaining access to your financial information, scammers can target their victims in a variety of ways with their respective phone numbers, from text messages to calls to WhatsApp messages.

However, the main objective of cyber scammers is to access the bank details of their victims, so when they call that number, they will receive the order to give the credit card number and the CVV to cancel the charge.

Click the link to subscribe to our news and media group on Telegram: https://t.me/G_ELSUMARIO_News

Source: dpa

La entrada Scam with Paypal allowed to capture bank details apareció primero en Bitfinance.

Apple blocked nearly $ 1.5 billion of potentially fraudulent transactions in 2021 as part of its App Store efforts to protect users from malicious or illicit activity.

The company founded by Steve Jobs uses various tools to detect illicit behavior, from App Review, which mixes automatic detection systems with a team of human reviewers to identify applications with potential problems or that may violate the rules of the digital store, to Discovery Fraud, to identify potential app, account, and even review fraud.

App Review, and especially the manual review process that workers do, “serves as a critical line of defense to help protect users from bad actors“, according to the company in a statement, where it collects the latest results of your annual fraud analysis for the past year.

This tool has allowed “reject or remove” in 2021 more than 835,000 new applications for presenting problems and 805,000 application updates. More than 34,500 apps were also rejected for having “hidden or undocumented features” and another 157,000 for being spam, copycats or displaying misleading behavior towards users.

The report data shows that the platform denied the publication in the App Store to more than 343,000 applications for requesting more data from users than was necessary for its operation.

When it comes to fraudulent activity, Apple acted on accounts, reviews, and transfers. In the latter case, its anti-fraud tool, which also combines automated systems with human reviews, prevented more than 3.3 million stolen cards from being used to make purchases and banned nearly 600,000 accounts from further transactions.

K. Tovar

Click the link to subscribe to our news and media group on Telegram: https://t.me/G_ELSUMARIO_Noticias

Source: Applesfera

La entrada Apple restricted more than $ 1 billion in fraudulent operations apareció primero en Bitfinance.

Through various publications on social networks, it has been possible to appreciate the capture of a WhatsApp text message or direct message in which a username and password of a supposed Exchange site (cryptocurrency exchange page) where it says there is a large sum of USDT or Tether, which is known as a stablecoin and whose value is equal to the US dollar in a 1:1 ratio.

MásQueSeguridad (MQS) warns through a statement that, in the message, a text is observed where the user is asked not to “share with anyone” said information. Thus, trying to get the person to enter the website, with the data provided. By doing so, the victim arrives at a false page in which there is a balance with a high sum of USDT. This is a well-known method of social engineering that seeks to gain the attention and enthusiasm of the victim.

Now, if the victims want to transfer said fake balance to their cryptocurrency wallet, the website created by the cybercriminals will request their access credentials, taking control of their account and allowing the attackers to keep their funds.

This deception was observed circulating with different domain names, but g structurally it is the same. Among the domains detected by the MásQueSeguridad team, usdtbonim.com, usdtcoindc.com, usdtethon.com, usdtlonim.com are mentioned, which have a creation date between April 20 and 24, 2022, which is an indication alert.

Similarly, the messages are sent from numbers of national operators in countries such as Colombia and Venezuela, which have already been duly reported as spam on various verification platforms, adds MQD in its preventive document.

That is why MáQueSeguridad recommends verifying through search engines, such as Google or databases like es.trustpilot.com, the reliability of any website that could be doubtful. In the same way, to check unknown telephone numbers on sites such as www.truecaller.com, www.listaspam.com, www.spamcalls.net, among others. Additionally, sharing this information on social networks, with friends and family, for preventive purposes, to limit the efficiency of such attacks.

With information from MásQueSeguridad

La entrada MQS: New scam to steal crypto wallet credentials is circulating on Internet apareció primero en Bitfinance.

Four people were recently detained by the Venezuelan authorities, in Carabobo state, for being allegedly linked to cryptocurrency scams. It was indicated by the director of the Scientific, Criminal Investigations Corps (CICPC), Douglas Rico on the social network Instagram.

The detainees are at the order of the Public Ministry with the accusation of counterfeiting and fraud with cryptocurrencies. The official reported that the citizens are part of a criminal gang called “The Counterfeiters of Cryptoassets” and legally represent a company linked to the ecosystem of cryptoassets.

According to the information provided by Rico, the alleged fraudsters “introduced a false registration authorization in order to obtain capital through advice and deceit third parties” and carried out their activities “through the Telegram messaging application.”

Other crimes related to cryptocurrencies

This is not the only case that has been registered in Venezuela related to cryptocurrency scams. During 2021, the Venezuelan authorities have registered several events, and according to the firm Chainalysis, it is the seventh nation with the highest adoption of cryptocurrencies.

One of the cases reported by authorities occurred last October when the CICPC arrested two men for defrauding $ 133,000 through the bitcoin exchange Binance. Another similar event occurred, last May, when the judicial body arrested two citizens for defrauding $ 130,000 on the LocalBitcoins platform.

While in June another citizen was also captured for allegedly appropriating 7.9 Bitcoins, equivalent, at that time, to more than $ 300,000.

Due to the boom that this type of event has been registering, within the Caribbean country, the CICPC director urges the community to use “regular and previously verified channels to trade crypto assets, always safeguarding integrity and using platforms that guarantee security.”

M. Rodríguez

Source: criptonoticias.com

La entrada Venezuelan authorities detain alleged cryptocurrency scammers apareció primero en Bitfinance.