Quantcast
Channel: CyberCrime & Doing Time
Viewing all 265 articles
Browse latest View live
↧

Facebook Lotteries to Avoid - with help from AA419

January 24, 2019, 9:46 pm
$
0
0
This morning I received a tip from one of the top West African fraud experts in the world, Derek Smythe from AA419. Derek and his team had been in communication with several victims of a "Poker Lottery" scam and had documented a set of linked domains.



PokersLottery[.]me website
The home page of these websites explains how the Lottery works:
Under The Gambling Act 2015, The Poker Lottery Online Board’s Purpose Is To Benefit The Facebook Community By Distributing The Profits From States Lotteries Run By The United State Of America,United Kingdom,Australia And Canada Lotteries Commission.

The Board Is Empowered By The Gambling Act To Make Allocations To Lottery Distribution Committees; The Minister Responsible For The Board For Distribution For Community Purposes; And This Statutory Bodies – A Worldwide Promotion For Disabled, Employed And Unemployed Workers, Retired, Young & Old People. A Sophisticated Automated Database To Randomly Select E-Mail Accounts And Profile Page Owners That Frequently Surf The Facebook. Consequent Upon This, Your Facebook Profile Account Was Chosen As A Winner. 
Doesn't that sound a bit suspicious?  Sure, if that's all there was ... but wait, there is more!
Each website has a list of the 100 "beneficiaries" who have been chosen to receive a prize!

AND IF YOU GOT A MESSAGE FROM THE LOTTERY ON FACEBOOK, YOUR NAME IS ON THE LIST!

Today is your lucky day!  Of course, since there are only 100 winners, they needed to make a bunch of these websites.  Derek and the team at AA419 documented quite a few of them yesterday and today, including these:

Poker Lotto domains, from AA419
The "Beneficiaries" pages all looked something like this, where each named individual is someone who has been invited to be scammed by receiving a Facebook message:

Beneficiary List from a Poker Lotto page

Another Beneficiary List Style
As far as we can tell, the "Status" has one of three meanings:

Delivered - you've already been suckered.
Not Yet Claimed - you've received the Facebook Message, but have not "verified" yourself.
Processing - you've provided your personal information, but they don't have your money yet.

The "AGENT/OFFICER IN CHARGE" link takes you to a Facebook Page, which will be the source of the message that you received via Facebook Messenger.  For many, this acts as a Verification.  They get a message, they follow the link, they see their own name, and when they click "AGENT/OFFICER" it takes them to the Facebook page of the person who sent them the message, completing the loop, and solidifying the concept that this is a "real thing."

Some of the AGENT/OFFICERs we found were:

https://www.facebook.com/clarkrobin.gayle.794
https://www.facebook.com/Dennis-Carney-303175227192556/
https://www.facebook.com/pg/Elizabeth-Cornwel-2280263318963057/

It is also possible that the "Delivered" statuses are just decoys, because who would actually fall for these scams, right?  Actually - according to AA419 and their law enforcement friends, these guys have already stolen money from dozens of victims!

So what happens next?  Next, we need to gather a bit of personal information so we know where to send your money, and make sure that we file your tax information about your winnings:

Necessary Information to Claim Winnings
There were actually several versions of the Verification Form, with some asking for an SSN while others did not.  We believe this may indicate what country that particular form was targeting.  For example, many of the victims were in South Africa, which does not identify their National ID number as a "Social Security Number."  By not having that field, they may avoid raising suspicion.

Quite a few of the websites are hosted on SquareSpace, who thankfully has been terminating the domains as AA419's team swung into action!  Thankfully several of them now look like this:

Well Done, SquareSpace!
So how much did the victims lose?  Strangely, it appears that you get to choose your own winnings, depending on how large a payment you are willing to make.  Yes, as you may have guessed if you are familiar with 419 Scams, there is a small fee that needs to be paid.

Cheap? Pay $1050 to claim $50,000.  Loaded?  Pay $420,000 to claim $20 Million!
On the form one fills out to choose their prize, note that one of the required fields is that you must upload your photo id!!!


Our advice?  Perhaps you shouldn't do that!

US Government Facebook Lotteries?

While Derek and I were exploring the sites and looking for additional ones, we realized that there is another version of the scam that imitates United States Federal Government Agencies.  All of the above works in exactly the same way, however instead of being branded "Poker Lotto" the websites take on a more "Official" tone.

The first one we found claims to be a service to help those who find themselves unemployed run by the United States Agency for International Development (USAID).

http://usaidwbenefits[.]com/
The USAIDWBENEFITS[.]COM website is hosted in NameCheap's data center in Los Angeles on the IP address 199.188.200.93.

There are sixteen pages of beneficiaries who have won the USAID WORLD BENEFITS award, listed in alphabetical order by first name

USAID Benefactors, from A ... 

... to Z 

The other US Government agency we found being abused in these scams was the Department of Labor.

wcabcompensations[.]com and also wcabdhhs[.]org

The "Winners List" from wcabdhhs[.]org

The WCAB / DHHS site is more advanced than the Poker Lotto sites, though not as advanced as the
USAID site, which seems to be the most recent in the evolutionary chain.

The Department of Labor doesn't seem to have as much money as Poker Lotto.  The "Claim" fees are smaller, but then so is the maximum prize:

Don't copy this!  It is (C) 2019 the Workers Compensation Appeals Board and the Department of Health & Human Services!

I'm not quite sure what the National Endowment for the Humanities has to do with this one . . . 

The address information left behind on this "Contact Us" form tells us a bit about how long these scams have been going on.  When we searched on the address information with the phrase "Claim Your Grant" as part of the search, we found that the National Endowment for the Humanities put out a press release on June 21, 2016 warning people about exactly this type of scam!  See: "Scam Impersonates NEH" on their website.

The Workers Compensation Board version of the scam is likely just as old, as one of their "AGENT" Facebook pages that are listed on these scam sites was created in 2015 and updated in 2016!  People may have been receiving notices of Lottery winnings from her account for a Very Long Time!

Asuncio from the Worker's Compensation Board has the odd Facebook Handle "CLAIM IT ONLINE1" 
The other Workers Compensation Appeals Board website did have an option to claim a LOT MORE MONEY, but you also had to pay a much larger fee:

$15 Million!  And all I have to send to Nigeria is $1.2 Million!  What a deal!
hippos://www.wcabcompensations[.]com/claim-compensation.html

A Facebook Lottery?

The last lottery of this type that we explored actually imitates Facebook itself.

YOU HAVE BEEN CHOSEN!!!!
The Facebook Benefit site also uses "A Sophisticated Automated Database to Randomly select E-mail Accounts And profile Page Owners that frequently surf the Facebook."

They like to capitalize almost as much as ME!

fbusersbenefit[.]com Beneficiary List
The agent for this one was - https://www.facebook.com/lise.richard8 

Could You Do Us A Favor?

WHEW!  That was a lot of Lottery Scams to review.  Could you do us a favor?

First, please share this blog post with your friends so they will be aware of this type of scam. Victims tend to be elderly and perhaps more trusting of computers, so sharing this with your older friends might be helpful.

Secondly, if you, a friend, or a family member has encountered any of these lottery scams and have saved any of your communications from the scammers, it would be SUPER HELPFUL if you could share that information.  Especially if you have email addresses or bank accounts that were used by the scammers.  

Feel free to leave me a comment below if you'd like to pass it to me, or if you are in the United States, please take a moment to share your details with the FBI's Internet Crime and Complaint Center, IC3.gov.   The great people at AA419 work closely with the website ScamSurvivors.com and would love to have you report details about anything you may have experienced related to this or other scams by visiting the Scam Survivors Forum.














↧
Search

Money Laundering and Counter-Terrorist Financing: What is FATF?

January 29, 2019, 8:52 am
$
0
0
Many cybercrime investigators seem narrowly focused on the bits and bytes of the crimes they investigate while not truly understanding or interacting with those who focus on where the money goes.  As we've been expanding our horizons, I've learned quite a bit and wanted to share some resources for others who may have been similarly limited in their focus.

The Financial Action Task Force (FATF) was established in 1989. It built a list of Forty Recommendations for countries to address Money Laundering, which were first issued in 1990, and revised in 1996, 2001, 2003, and 2012.  Their latest FATF Annual Report (2017-2018) addresses Terrorist financing as well as new methods and trends and announces a research project on financing of recruitment for terrorism.  Many of these Recommendations meet our lives in the form of regulations on financial institutions and interactions between international law enforcement agencies.
"Regardless of their size and complexity, the financial activities and channels of terrorists are an essential source of intelligence.  Financial investigation can identify terrorist cells, their associates and facilitators, and reveal the structure of terrorist groups, and their logistics and facilitation networks." -- FATF President Santiago Otamendi, 14DEC2017, NYC.
FATF also released an important report "Financing of Recruitment for Terrorist Purposes" in January 2018, and a second report "Concealment of Beneficial Ownership" in July 2018.
Beneficial Ownership (July 2018)
Terrorist Recruitment (January 2018)
FATF is composed of 38 member states, covering most of the major financial centers of the world. Each of these member states has pledged to come into compliance with the Forty Recommendations, and to measure its progress.

The FATF Forty Recommendations on Money Laundering and Counter Terrorism Finance

International Standards on Combating Money Launderingand the Financing of Terrorism& Proliferation (Oct 2018)
The Recommendations fall into seven major categories:

A - AML/CFT Policies and Coordination
  • R1. Asessing risks & applying a risk-based approach
  • R2. National cooperation and coordination


B - Money Laundering and Confiscation

  • R3. Money laundering offense 
  • R4. Confiscation and provisional measures


C - Terrorist Financing and Financing of Proliferation

  • R5. Terrorist financing offense
  • R6. Targeted financial sanctions related to terrorism and terrorist financing
  • R7. Targeted financial sanctions related to proliferation 
  • R8. Non-profit organizations


D - Preventative Measures

  • R9. Financial institution secrecy laws
  • R10. Customer due diligence 
  • R11. Record keeping 
  • R12. Politically exposed persons
  • R13. Correspondent banking
  • R14. Money or Value transfer services
  • R15. New technologies
  • R16. Wire transfers 
  • R17. Reliance on third parties 
  • R18. Internal controls and foreign branches and subsidiaries
  • R19. Higher-risk countries
  • R20. Reporting of suspicious transactions
  • R21. Tipping-off and confidentiality 
  • R22. Designated non-Financial Businesses and Professions: Customer due diligence
  • R23. Designated non-Financial Businesses and Professions: Other measures 


E - Transparency and Beneficial Ownership of Legal Persons and Arrangements

  • R24. Transparency and beneficial ownership of legal persons
  • R25. Transparency and beneficial ownership of legal arrangements 


F - Powers and Responsibilities of Competent Authorities and Other Institutional Measures

  • R26. Regulation and supervision of financial institutions
  • R27. Powers of supervisors
  • R28. Regulation and supervision of Designated non-Financial Businesses and Professions
  • R29. Financial intelligence units
  • R30. Responsibilities of law enforcement and investigative authorities 
  • R31. Powers of law enforcement and investigative authorities 
  • R32. Cash couriers 
  • R33. Statistics
  • R34. Guidance and feedback 
  • R35. Sanctions 


G - International Cooperation

  • R36. International instruments 
  • R37. Mutual legal assistance 
  • R38. Mutual legal assistance: freezing and confiscation
  • R39. Extradition 
  • R40. Other forms of international cooperation 


Mutual Evalution and Ranking of Members  

4th Round Ratings
In this chart, each member state, including the Associate members, is ranked on how well they comply with each of the 11 "Immediate Outcomes" and 40 Recommendations.  For example, the United States is currently not compliant with recommendations 22, 23, and 24 -- so, we don't do well in non-financial institutions, and our shell company games are impossible to monitor as of now, but we do generally do well in most others.  Clicking the "4th Round Ratings" label will take you to the full chart.  If you do international business, it may be a form of risk doing businesses in countries with poor ratings across the board here.

FATF Member Assessments

Each member is encouraged to perform regular assessments to measure themselves on how they are complying with the Forty Recommendations.  Here are example reports from the United States, but these reports are available for every country that participates in FATF or one of the Associate Members.  In the United States, these assessments are published by the Department of the Treasury.  These reports were issued in 2015 by the Treasury Undersecretary for Terrorism and Financial Intelligence, Adam Szubin.

2015 Money Laundering Risk Assessment

2015 Terrorist Financing Risk Assessment

The goal of sharing these examples is to serve as a reminder that from the FATF site, ALL such reports for all member states are available, by looking for the "Mutual Evalutions Publications." As of this writing the four newest ones are from Tunisia, Nicaragua, Panama, and Tajikistan.

FATF Associate Members

FATF also has 9 Regional Bodies, considered "FATF Associate Members" each of which put out specialized information for their portion of the world.  For those who are interested in that Region, following up on those specific regions reports from their representative task forces and groups will be worthwhile.

A Special Focus on Terrorist Financing Risks 

FATF issued their first special report offering guidance on Terrorist Financing in 2008:


Several more recent reports would be especially interesting regarding terrorist financing, stemming from an emergency meeting of 55 states, the United Nations, the Egmont Group of Financial Intelligence Units, the International Monetary Fund, the World Bank, and others specifically to address curbing the financing of ISIS/ISIL.



In the Paris meeting of 19OCT2018, FATF encouraged members to expand their focus from looking specifically at ISIL to more broadly include Al Qaeda and its Affiliates, issuing this guidance:



Regional Terrorist Financing Focuses

There have also been significant regional reports issued by sub-groups and associate members.

The Counter-Terrorism Financing Summit, hosted by Australia's Financial Intelligence Agency (AUSTRAC) and the Indonesian counterpart, Pusat Pelaporan dan Analisis Transaksi Keuangan (PPATK), issued the Regional Risk Assessment on Terrorism Financing 2016.  The following year, the event was repeated, adding Bank Negara Malaysia as a partner.  These events issued two small statements, and one more substantial report, addressing events in Philippines, Thailand, Malaysia, Singapore, Indonesia, and Australia, and how those events were funded.

A risk methodology for their region (p.22)

The Nusa Dua Statement - August 2016 
Kuala Lumpur Communique - November 2017 


West and Central Africa have very different concerns, and held a summit to discuss these differences, resulting in this excellent joint publication: 

"Terrorist Financing in West and Central Africa", October 2016
50 page joint report from FATF, GIABA, and GABAC


Particular Funding Methods for Terrorism Finance

Many other special reports have been issued, related to the trade in:

Virtual Currencies of Growing Concern

In the Paris meeting 19OCT2018, a special issue that was raised was the Regulation of Virtual Currencies.  This was deemed to be a matter of strategic interest that will be further evaluated, especially with regard to Initial Coin Offerings and their role in Money Laundering.  FATF has committed to work with the G20 to come up with new guidelines to update their previous report "Virtual Currencies: Key Definitions and Potential AML/CFT Risks" as well as their report "Guidance for a Risk-based Approach to Virtual Currencies" (June 2015 - 46 page PDF).  

The work so far is in the form of a report to the G20, which addresses many topics in addition to Virutal Currencies:

(July 2018) 

In part the report shares:

"Noting that virtual currencies/crypto-assets raise issues with respect to money laundering and terrorist financing, they committed to implement the FATF Standards as they apply to virtual currencies/crypto-assets.  They looked forward to the FATF review of those Standards, called on the FATF to advance global implementation, and asked the FATF to provide an update on this work in July 2018.  The FATF will take this work forward under the US presidency from 1 July 2018 to 30 June 2019."

This work begins with first reviewing laws and regulations regarding crypto-assets and virtual currencies in each of the G20 states.

More on this topic will certainly be forth-coming from FATF.




↧
↧

FTC shutters four Robocalling services that made billions of calls in 2018

March 27, 2019, 6:36 pm
$
0
0

The Federal Trade Commission announced settlements this week that could result in many fewer of those annoying Robocalls we've all been receiving.  Who did they sanction and what were those companies doing?

NetDotSolutions (James Christiano)

James Christiano ran a company that provided and operated softwarea called "TelWeb," a call spamming platform.  His software violated several laws, including places marketing calls to people on the "Do Not Call" list, and using a spoofed caller id, intending to deceive call recipients.


Of 883 Million robocalls per year, on the average, 157 million of the calls placed by TelWeb went to numbers on the National Do Not Call Registry.  At least 54 Million calls, just in the first half of 2016, had spoofed caller ID numbers.  The FTC received almost 8,000 consumer complaints against this company, which contributed greatly to choosing to pursue this lawsuit!

His companies, NetDotSolutions and TeraMESH Networks, were both named in the suit.  Additionally, Aaron Michael Jones and Andy Salisbury, two resellers of TelWeb, are both also named in the suit.  Which brings up one problem with these types of suits.  Jones was already "permanently banned" from doing telemarketing.  Salisbury and World Connection were each fined $2.7 million dollars. Nine of his previous companies were also subject to the ban previously:  1) Allorey, Inc.; 2) Audacity LLC; 3) Data World Technologies, Inc.; 4) Dial Soft Technologies, Inc.; 5) Digital Marketing Solutions, Inc.; 6) Savilo Support Services, Inc.; 7) Secure Alliance, Inc.; 8) Velocity Information Corp.; and 9) World Access Media. 

Jones was also one of those charged in the Point Break Media case, where callers were told to "Press 1 to speak to a Google Specialist" who told them they were about to be "unlisted" from Google and charged them at least $169 to not be deleted from Google search results.

Higher Goals Marketing

Have you had the Robocall about reducing your credit card interest rate?  It may have been coming from Higher Goals Marketing.  "According to the FTC’s complaint, Higher Goals Marketing LLC, Sunshine Freedom Services LLC, Brandun L. Anderson, Lea A. Brownell, Melissa M. Deese, Gerald D. Starr, Jr., and Travis L. Teel, have engaged in a telemarketing scheme that has deceived financially distressed consumers nationwide by pitching bogus credit-card interest-rate-reduction services."

Unfortunately, this is another case demonstrating that to robocallers, a multi-million dollar fine is just a slap on the wrist.  The defendants were helped with setting up their service just weeks by Wayne Norris, just weeks after he was put out of business by a previous FTC settlement against the company he was working for, Life Management Services, back in 2016.  He  is charged with violating the Telemarketing Sales Rule by helping the other defendants organize the telemarketing infrastructure they used to bombard consumers with illegal robocalls, putting a team of managers together to oversee the entire robocall operation, and helping to set up a shell company to collect illegal up-front fees from consumers.

In the case of Life Management Services, Wayne was asked to handle registering the new company for his boss, Steven Guise, because Guise was permanently banned from telemarketing.  He did so by asking a friend of his wife's to register the company in Florida. (See p.6 of this 51 page order .. https://www.ftc.gov/system/files/documents/cases/life_management_order_and_permanent_injunction_kevin_guice.pdf ) 

Wayne is behind the calls that start "This is Rachel, from Cardholder Services?"  In 2012, the FTC Chairman Jon Leibowitz declared Rachel from Cardholder Services "public enemy number one."  Back then, Wayne worked for Ambrosia Web Services.

Travis Deloy Peterson

You'll probably also be familiar with Peterson's "Veteran scams".  Using many different fake charity names, including Veterans of America, Vehicles for Veterans LLC, Saving Our Soldiers, Donate Your Car, Donate That Car LLC, Act of Valor, and Medal of Honor, Peterson made millions of calls asking people to donate a vehicle to help a veteran.

In addition to paying more than a $500,000 fine, Peterson also has to return 88 vehicles that he's stolen under the guise of a charitable donation.

Point Break Media 


A fourth settlement by the FTC this week targeted people offering false Google Business services.  Dustin Pillonato; Justin Ramsey; Aaron Michael Jones, a/k/a Michael Aaron Jones and Mike Jones; Ricardo Diaz; Michael Pocker; Steffan Molina, Vincent Yates, and Daniel Carver were all charged individually in the case.   Three primary defendants in this case have agreed to settle.

More details on the case can be found in the court order here:  https://www.ftc.gov/system/files/documents/cases/pointbreak_media_-_pocker_defendants_stipulated_order.pdf







↧

Dissect Cyber wins major DHS S&T Award for their BEC Work

March 28, 2019, 5:43 am
$
0
0
Congratulations to our great friends at Dissect Cyber for receiving the DHS S&T Global Award for their work on BEC scams!

The FBI has been warning companies for several years now of the growing prominence of Business Email Compromise (BEC) scams as being one of the top forms of cyber crime based on the volume of dollars stolen.  A single BEC scam can often lead to six-figure and even seven-figure losses!  According to a June 2018 BEC report from the Internet Crimes Complaint Center, so far the FBI has documented $12,536,948,299 in losses stolen from 78,617 businesses.

Dissect Cyber decided that the best way to attack these scams and help protect those at-risk companies was to create an early warning system called Cyber Notify, based on their analysis of the vulnerable (and detectable) points of a BEC scam that is ABOUT TO HAPPEN!  To understand why their solution is so powerful, let's look at how a BEC fraud group is structured.

BEC Org Charts

Some of the leading experts in Business Email Compromise have documented the significant role in these scams played by West African cyber criminals.  Experts such as John Wilson, Crane Hassold, and Ronnie Tokazowski at Agari are doing some great work Investigating BEC Scams actors to learn more about how they commit their crimes.  The SecureWorks experts are documenting the role of malware in BEC crimes, and produced a great chart explaining the roles of the various actors, reproduced here from their report "Golden Galleon: How A Nigerian Cybercrime Crew Plunders the Shipping Industry."

SecureWorks BEC Org Chart
In that document, American researchers assigned names to each of the roles that make up a BEC scam.  One of those roles in the SecureWorks report is "Cloner" which is described as the person who "Registers domain names for impersonating email addresses."

The West African fraud experts at AA419 (Artists Against 419) provide a similar chart, but label their content based on the names the fraudsters use themselves.  In their diagram, the "Cloner" role is called within the West African fraudster community, a "Faker Maker."  While they do create domain names that closely imitate real organization names to be used in email, they often are also responsible for creating entire fraudulent organizations, complete with corresponding web sites, in order to facilitate their fraud, including fake travel agencies, fake government organizations, fake shipping companies, fake job websites, and fake lotteries.

AA419 BEC Org Chart
The AA419 staff did an excellent blog post explaining the critical role of The Faker Maker in December 2017.

Enter Dissect Cyber and Cyber Notify

I've known and worked with April Lorenzen, the founder of Dissect Cyber and Zetalytics, and her staff and products for many years.  She has been passionate about building tools for law enforcement and investigators to quickly understand the relationships between domain names, their name servers, and the IP addresses which host them.  She's also been generous enough to share her tools with researchers in my lab, including sharing them with our UAB Cyber Detective Camp last summer!  Whether we are doing phishing investigations, malware investigations, or illicit pharmaceutical investigations, Dissect Cyber has been a great partner!

Based on the organizational charts above, what Dissect Cyber realized was that part of the PRECURSOR events to having a new BEC attack often involve the creation of a "look-alike domain" that will imitate the company being targeted.  We've blogged many times about how BEC attacks work, such as our article "Business Email Compromise: Putting a Wisconsin Case Under the Microsope." Often, such as in two of the victim cases described in the Wisconsin case, the criminals are monitoring the emails of key executives, having already planted email-stealing malware on their computers, watching for an opportunity when they are traveling or otherwise unavailable.  During that scheduled outage, an employee will receive an "urgent command" that they must quickly pay an invoice, wire some funds for a merger, or some other large financial transaction.  By having the email come from a domain that is VERY SIMILAR to the true email domain, the employee often does not realize that this is not really The Big Boss, and they will comply with the financial transfer order they receive.

This is where Dissect Cyber comes in.  Because they have full visibility of EVERY NEWLY CREATED DOMAIN ON THE INTERNET, they created the Cyber Notify system to check each new domain to see if it might be a counterfeit look-alike domain. If so, their team of highly trained and vetted professionals (at the moment, all members of the alert team are military veterans), reach out to the imitated organization to help them understand that they may be about to be targeted with a BEC attack.

According to the press release from Dissect Cyber, this work has helped 1,500 companies prevent themselves from losing $407 million dollars which was requested to be wire transferred by the scammers who had created these fake domains!  Priority notifications are given to those companies that are part of the nation's Critical Infrastructure as defined by DHS.  Why?  While the techniques that have been broadly been used to steal money by West African scammers are the majority of the financial losses as reported by the IC3.gov team, the scarier fake domain attacks may be foreign nation state actors who are using the techniques refined by the West Africans to send dangerous emails that could have an impact on anything from our power grids to our water supply to employees of those critical infrastructure companies!

Congratulations, Dissect Cyber!  I hope that Cyber Notify (cybernotify.org) will grow, expand, and continue to innovate in ways to help us all protect our vulnerable small and medium-sized businesses from fraud, while also protecting our Critical Infrastructure businesses from nation state espionage hackers!


↧

Twitter Mystery Followers: ? GarBot ?

April 2, 2019, 3:49 am
$
0
0
I'm one of those people who tends to review the people who are following me on Twitter and to block a great number of them.  Why?  Because many of them aren't real people!

Here are a few examples:

@Juliettemasker

Juliette only has one tweet and it says "Just setting up my Twitter.  #myfirstTweet"

Gosh, the pretty blonde whose random mashup of bio statement says "Author, Musician, Harry Potter Lover, Idea Agent, Troll King, You're beautiful" must be a cyber security fan who has read some of my tweets and was inspired to follow me, right?

More likely, she is part of the botnet that has been assigned to search for the three character string "GAR" and follow people who come up in the search results.  Like these folks:



This has been going on for some time . . . in fact, the shortcut for me is to look at the followers of "@gar" (the "communist socialist libertarian anarchist who likes tacos") on that last row.  Almost all of this guy's recent followers are part of this bot:


How can we be sure?  Well, they do have something in common . . . besides a desire to follow people with "Gar" in their name or bio.  See if you can spot the pattern?








Many of the images are coming from "royalty free stock images" sites, which might imply someone is trying to be "legal" with their bot ... not sure.




And lest you think this is just a "pretty girls who follow you" bot, there are male accounts as well, although recently the males seem to be primarily Spanish (or Catalan):



And these accounts also share their passion for people named "Gar"  . . . 


More Tweets of Wisdom

Over time, the accounts do tweet things other than "Just setting up my Twitter. #myfirstTweet".  They share great wisdom such as:

"Love sees no faults" ... "Hope is life"  ... "Every bird loves to listen to himself sing"


I don't know if you can call Shery's post "wisdom" -- "i hate #cats" and "i love #dogs" and "i don't think there is such thing as too much #coffee"



StonerBot Variant

One odd variation of this bot is something I think of as "StonerBot" ... it starts out the same way.  @Janecarrson started with "Just setting up my Twitter #myfirstTweet" and following a bunch of Gar accounts:




But then things quickly go off the tracks ... in a decidedly marijuana friendly way:





StonerBotJane has posted 20 photos, instead of just one liners, and expanded beyond her "Gar" following to follow many other accounts, several of which feature nudity in their profile pictures.  Also, unlike my "GarBot" followers, StonerBotJane has a cover photo.

Looking at some of the other people's accounts that were followed by "GarBot" it was easy to spot many other "StonerBot" variants.  These all follow "@ColegSirGar" 

Victoria, Deirdre, Maria, Jane, and Leah, all behave like StonerBotJane, while Sarah, Olivia, and Julia are all more like the original "GarBot" (which surely must follow people with other names as well, but the version I am most familiar with, for obvious reasons, I refer to in my head as "GarBot."

Actually, Sarah Black is a good bot going stoner ... she still hasn't gone to posting drug photos, but her two most recent follows were 'non-Gar' accounts of questionable topics, and although she still hasn't chosen a cover photo, she did post a photo in a tweet with a drug reference.


Sarah's path to corruption includes forsaking the following of "Gar" accounts and choosing to follow two pornographic Twitter accounts ... 


Her last tweet was "Gonna roll a jay before I eat this beauty."

I think I'll stop there ... but I would certainly be interested in hearing from you if you have found your own version of a "GarBot" following you and others with similar names.  I'm genuinely curious how far this thing goes.  If you happen to know what research team is behind this project, please feel free to send me a note about that as well!

Thanks! 

A few more of my "GarBots" . . . just in case more examples help anyone who is researching this trend themselves . . . 




















↧
↧

IC3.gov: BEC Compromises and Romance Fraud 2018

April 30, 2019, 6:45 am
$
0
0
The Internet Crime & Complaint Center, IC3.gov, publishes annual statistics about the crimes which have been reported to them during the previous calendar year.  The full report offers insights and analysis into current trends in cybercrime.  While it is widely acknowledged that cybercrime is dramatically under-reported, there are still some shocking trends when looked at on a state-by-state breakdown.

https://www.ic3.gov/media/annualreports.aspx
While the IC3 has been collecting Internet Crime complaints since 2000, starting in 2016, the IC3 provided a more detailed state-by-state breakdown than  ever before, allowing us to see how many victims experienced how much loss by crime type reported.  What is abundantly clear in the 2018 numbers is that the greatest dollar losses among the reports are coming from Business Email Compromise.

Previous reporting from IC3.gov called Business Email Compromise The $12 Billion Scam (July 12, 2018), although quite a bit of that figure is "exposed dollar value" - meaning how much the criminals COULD have lost.  Actually losses in the US in reports gathered by the IC3 included $1.3 Billion stolen from 21,723 domestic companies from October 2013 to May 2016, and $1.6 Billion stolen from 19,335 domestic companies from June 2016 to May 2018.

In the 2018 State by State breakdown, we find documentation of 19,140 companies losing $1.2 Billion stolen from companies in the 50 states, with millions more from DC, Puerto Rico, and other US territories.  That means on the average day in 2018, criminals stole $3.3 Million dollars from 52 US businesses per day.

StateBEC LossesBEC VictimsAverage Loss Per VictimVictims per 100,000 PopulationBEC Losses per 100,000
Alabama$7,542,651190$39,6983.89$154,314
Alaska$777,53966$11,7818.92$105,102
Arizona$19,364,749401$48,2915.72$276,008
Arkansas$3,187,56393$34,2753.09$105,765
California$190,033,2053032$62,6767.67$480,610
Colorado$16,742,410453$36,9598.08$298,598
Connecticut$23,879,979263$90,7987.33$665,551
Delaware$831,59843$19,3394.45$85,983
Florida$82,979,7681433$57,9066.73$389,589
Georgia$38,310,258446$85,8974.44$381,462
Hawaii$3,119,42678$39,9935.49$219,602
Idaho$3,001,04085$35,3064.85$171,077
Illinois$50,139,264745$67,3015.82$391,713
Indiana$19,845,399265$74,8883.96$296,559
Iowa$9,491,169126$75,3274.01$301,690
Kansas$11,152,097142$78,5364.88$383,035
Kentucky$3,399,040152$22,3623.41$76,314
Louisiana$6,785,75325$271,4300.54$145,618
Maine$767,59753$14,4833.97$57,455
Maryland$29,185,800414$70,4976.84$482,250
Massachusetts$46,339,422595$77,8818.67$675,502
Michigan$27,174,665451$60,2544.53$272,783
Minnesota$26,090,980312$83,6255.59$467,832
Mississippi$2,618,16357$45,9331.91$87,666
Missouri$13,191,920229$57,6073.75$215,766
Montana$1,793,38938$47,1943.58$168,821
Nebraska$5,419,13383$65,2914.3$280,891
Nevada$6,110,393217$28,1587.24$203,816
New Hampshire$2,783,48786$32,3666.4$207,259
New Jersey$54,132,347554$97,7126.22$607,647
New Mexico$3,158,731101$31,2754.84$151,280
New York$124,028,6391288$96,2966.59$634,671
North Carolina$29,829,247436$68,4164.25$290,450
North Dakota$427,37931$13,7864.08$56,228
Ohio$70,274,973539$130,3804.62$602,701
Oklahoma$5,425,276147$36,9073.74$138,013
Oregon$14,585,319272$53,6226.57$352,047
Pennsylvania$30,638,648715$42,8515.58$239,232
Rhode Island$3,543,031115$30,80910.85$334,248
South Carolina$8,077,180201$40,1854$160,772
South Dakota$836,73428$29,8833.17$94,843
Tennessee$16,072,195297$54,1154.42$239,312
Texas$117,017,1472094$55,8827.4$413,488
Utah $7,931,467201$39,4606.48$255,689
Vermont$687,93443$15,9986.89$110,306
Virginia$18,992,122662$28,6897.82$224,228
Washington$30,899,686507$60,9466.85$417,225
West Virginia$2,093,28050$41,8662.75$115,269
Wisconsin$10,588,528257$41,2004.43$182,718
Wyoming $1,637,11629$56,4525.02$283,367


The table above shows Business Email Compromise losses by state for calendar 2018, as based on complaints received by the team at IC3.gov.  These are losses experienced by BUSINESSES.  As you can see, the average loss by business varied greatly from state to state.  Alaska only lost $11,000 per BEC case, while Ohio had $130,000 lost per BEC case and the average BEC case in Kentucky lost $271,000!  The average loss from a BEC scam in the 50 states in calendar 2018 was $62,849 per business.  ($1,202,934,836 stolen from 19,140 businesses.)

The Top Ten states for BEC by the number of victims per 100,000 population are:
Rhode Island - 10.85
Alaska - 8.92
Massachusetts - 8.67
Colorado - 8.08
Virginia - 7.82
California - 7.67
Texas - 7.4
Connecticut - 7.33
Nevada -  7.24
Vermont - 6.89

The median number of BEC victims per 100,000 by state was 4.86.
(My home state of Alabama was #41 at 3.89)

The Top Ten states for BEC by average losses per victim are:
Louisiana - $271,430
Ohio - $130,380
New Jersey - $97,711
New York - $96,295
Connecticut - $90,798
Georgia - $85,897
Minnesota - $83,624
Kansas - $78,535
Massachusetts - $77,881
Iowa - $75,326

The median state for "average loss per victim was: $47,742.80
(Alabama was #33 at $39,689 average loss per victim)

The table below documents the category of fraud that the IC3.gov team labels as "Confidence Fraud / Romance".  We know that Romance scams tend to target the lonely and the elderly in a disproportionate way, and are often enabled by social media.  While the average losses per incident are lower, realize that these are often losses experienced by a senior citizen, often representing the loss of their entire life savings!  The average loss from a Romance scam in the 50 states in calendar 2018 was $19,114.14.  ($296,613,212 stolen from 15,518 individual victims.)


StateRomance LossesRomance VictimsAverage Loss Per VictimVictims per 100,000 PopulationRomance Losses per 100,000
Alabama$1,796,307235$7,6444.81$36,750
Alaska$1,077,48785$12,67611.49$145,647
Arizona$7,975,890429$18,5926.11$113,681
Arkansas$1,332,727135$9,8724.48$44,220
California$72,355,4752105$34,3735.32$182,993
Colorado$4,782,810376$12,7206.71$85,301
Connecticut$3,956,170143$27,6663.99$110,261
Delaware$927,25948$19,3184.96$95,873
Florida$20,555,5381191$17,2595.59$96,508
Georgia$6,626,814361$18,3573.59$65,984
Hawaii$1,207,60859$20,4684.15$85,013
Idaho$1,463,39788$16,6305.02$83,422
Illinois$6,342,425433$14,6483.38$49,550
Indiana$5,390,594273$19,7464.08$80,554
Iowa$3,321,947165$20,1335.24$105,593
Kansas$2,047,571161$12,7185.53$70,327
Kentucky$1,527,974210$7,2764.71$34,306
Louisiana$2,063,99965$31,7541.39$44,292
Maine$883,37268$12,9915.09$66,121
Maryland$4,180,307316$13,2295.22$69,073
Massachusetts$8,004,624346$23,1355.04$116,685
Michigan$9,487,821461$20,5814.63$95,240
Minnesota$5,737,051287$19,9905.15$102,870
Mississippi$464,302108$4,2993.62$15,547
Missouri$5,849,242319$18,3365.22$95,670
Montana$500,41542$11,9153.95$47,107
Nebraska$1,782,49792$19,3754.77$92,392
Nevada$6,282,784254$24,7358.47$209,566
New Hampshire$1,068,70468$15,7165.06$79,576
New Jersey$8,275,788332$24,9273.73$92,897
New Mexico$2,608,857140$18,6356.7$124,945
New York$16,867,421782$21,5704$86,313
North Carolina$2,686,807432$6,2194.21$26,162
North Dakota$1,303,70235$37,2494.6$171,522
Ohio$9,085,821424$21,4293.64$77,923
Oklahoma$2,339,940164$14,2684.17$59,525
Oregon$2,713,780266$10,2026.42$65,503
Pennsylvania$10,029,245577$17,3824.51$78,310
Rhode Island$1,389,85451$27,2524.81$131,118
South Carolina$3,439,585187$18,3943.72$68,463
South Dakota$99,74731$3,2183.51$11,306
Tennessee$5,101,479268$19,0353.99$75,960
Texas$20,635,5591238$16,6684.37$72,917
Utah $2,380,004172$13,8375.54$76,725
Vermont$129,32225$5,1734.01$20,736
Virginia$9,128,873480$19,0185.67$107,779
Washington$2,062,979493$4,1856.66$27,856
West Virginia$1,367,24774$18,4764.07$75,289
Wisconsin$5,603,169391$14,3306.75$96,690
Wyoming $370,92233$11,2405.71$64,203

The Top Ten states by the number of Romance Scam victims per 100,000 population are:

Alaska - 11.49 victims per 100,000
Nevada - 8.47
Wisconsin - 6.75
Colorado - 6.71
New Mexico - 6.7 
Washington - 6.66
Oregon - 6.42
Arizona - 6.11
Wyoming - 5.71
Virginia - 5.67 

The median number of victims per 100,000 population was 4.79.
(Alabama was #25 with 4.81 victims per 100,000 population) 

The Top Ten states by average loss per Romance Scam victim are:
North Dakota - $37,248
California - $34,373
Louisiana - $31,753
Connecticut - $27,665
Rhode Island - $27,252
New Jersey - $24,927
Nevada - $24,735
Massachusetts - $23,134
New York - $21,569
Ohio - $21,428 

The median average loss per state was $17,858.
(Alabama was #44 with average Romance Scam losses of $7,634 per victim.) 







↧

The Next Miami Operation WireWire Case: Alfredo Veloso

May 7, 2019, 10:02 pm
$
0
0
In June of 2018, we blogged about a series of cases that the Department of Justice announced as "Operation: WireWire." In particular, we wrote three pieces about the "South Florida Cases" where a Lebanese recruiter convinced people to set up shell companies, open bank accounts, and receive large wire transfers that were quickly sent overseas.  (See Operation WireWire: The South Florida Cases -- Part 1, Part 2, and Part 3.)

Some of the earlier cases included US v. Eliot Pereira et al; US v. Gustavo Gomez et al; and US v. Cynthia Rodriguez et al.  So far, at least 250 shell corporations in South Florida have been identified that can all be linked back to the Roda Taher Money Laundering Network.  Those recruited communicated with Roda Taher, who was known as Rezi or Ressi, via WhatsApp and Email, including the gmail account "rezimarket@gmail.com." 

On April 30, 2019, DOJ announced another related guilty plea.  This time three more related cases are linked under the name "USA v. Lugo et al."

Alvaro Lugo of Sunrise, Florida, Karina Rosada of Hollywood, Florida, and Alfredo Veloso are the main trio of defendants in these cases, with Veloso pleading guilty on April 30, 2019. 

Karina Rosado

Karina Rosado ran her shell company as "Karina Luxury Trade" through her address 4001 West Flagler Street, Apr 18, Coral Gables, Florida.  Karina received both her papers of encorporation and her IRS EIN number via email from Rezi in June and July of 2017.  On August 7, 2017, Karina opened a Bank of America account ending in 8775 with a $25 deposit.  On August 18th, she received a $105,000 wire from a Business Email Compromise victim scammed by impersonating a title company person.  On August 21st, Karina withdrew $7,500 in cash, and wired $44,700 to "Tianjin Shengfa Candle Co" at China Zheshang Bank and an additional $39,988 to "Jiangxi Textile Group Imp" at Bank of China on 21AUG2017.  She drained the rest of the account, $8,800, the following day.

On August 2, 2017, Karina opened a TD Bank account ending in 2712. 

She also opened a Wells Fargo account ending in 5271 the same day.  On September 20, 2017, she received a $32,900 wire from a second victim, and on September 21, 217, an additional $59,890 was attempted from a third victim, but was blocked by the victim's bank, who filed an IC3.gov complaint on October 8, 2017.  A fourth victim wired $17,609 to her Wells Fargo account on November 2, 2017.  She withdrew another $10,000 on November 6, 2017, and $17,690 on November 9, 2017, closing the account.

On November 13, 2017, Karina opened a JP Morgan Chase account ending in 3657, providing her business name and her true social security number.  She deposited $17,609 dollars to open the account, listing in the memo, her Wells Fargo bank account number "2846705271."

After an arrest warrant was sworn out on August 20, 2018, Karina surrended on August 27th.  She posted bail on September 10, 2018, and was declared a fugitive after failing to appear on December 20, 2018.  Like several of the previous WireWire mules, Karina attended Miami Dade College in Hialeah, Florida.

Alvaro Lugo

Alvaro Lugo opened a Florida shell company "Lugo Wide Trades" from his address at 11149 NW 80th Lane, Doral, Florida.  The address he used matches his home residence address according to Florida's Driver and Vehicle Information Database.  When the company filed for its EIN number with the IRS, the IP address used to do so was in Beirut, Lebanon, and matched the IP address used to request EIN numbers for several other shell companies that were part of this network.  (Roda Taher is from Lebanon.)

Lugo opened a Bank of America account ending in 4361, using his social security number and drivers license to do so.  On October 30, he received a wire from "a motorsports dealership" in the amount of $105,532.09.  On October 31, he received an additional $74,857.69 from another victim company.  Both of these companies filed complaints at IC3.gov.  On November 3, Lugo cashed out the account with a $180,486.36 cashier's check payable to Lugo Wide Trades, Inc.

On October 26, 2017, Lugo opened a JPMC account ending in 1705.  The account was opened with $50.  On November 2, 2017, Lugo's account wrote a $50 check paid to Rosado's account.

Lugo was sentenced on April 8, 2019 to 34 months in prison.

Alfredo Veloso

Veloso's company was Veloso Bulk Trading which was registered to the address 6611 SW 99th Avenue, Miami, Florida.  In addition to Veloso Bulk Trading, Alfredo ran several other businesses from this address, including Tri Reptiles, a reptile importing company.  He also ran a "kink pornography" business from the same address, "Alex Ace 305 Productions Inc" which used the main website "kink305[.]com".  "Alex" is part of a group of 76 porn-related domain names and at least eight of the mules he recruited were women he ment through his internet video business, who were also used to open shell companies and associated bank accounts for the network. 

Veloso Bulk Trade received incoming wires totaling more than $1,000,000 from four victims - two corporations, a law firm, and an individual.  Veloso withdrew $26,686 of the funds.

In Veloso's Plea Agreement, signed on April 29, 2019, he agrees to plead guilty to counts 1 and 4 through 8.  To wit: 

1. Conspiracy to commit money laundering in violation of Title 18, USC section 1956(h) because he "did willfully with the intent to further the objects of the conspiracy, and knowingly combine, conspire, confederate, and agree with Alvaro Lugo, Karina Rosado, and others known and unknown, to knowingly conduct and attempt to conduct a financial transaction affecting interstate commerce, which transaction involved the proceeds of specified unlawful activity, knowing the property involved in the financial transaction represented the proceeds of some form of unlawful activity, knowing that such transaction was designed, in whole and in part, to conceal and disguise the nature, the location, the source, the ownership, and the control of the proceeds of specified unlawful activity, in violation of Title 18 USC Section 1956(a)(1)(B)(i) and all in violation of Title 18 USC Section 1956(h).  The specified unlawful activities were conspiracy to commit wire fraud, (Title 18 USC Section 1349) and Wire Fraud (Title 18 USC Section 1343).

Counts 4 through 8 are actually all Lacey Act offenses, related to smuggling reptiles through his "Tri Reptiles" company.

His Base Offense Level was an 8.  It goes up by 16 due to the volume of funds laundered (between $1.5 Million and $3.5 Million). +2 more for sophistication, and +2 more for being a section 1956 conviction, and +3 more because he was a "manager or supervisor, but not an organizer or leader, of criminal activity involving five or more participants."  That would give a 29, but he got a three level decrease for "demonstrating acceptance of responsibility."   He's likely looking at 63 to 78 months in prison.  The prosecution agreed to run the animal smuggling sentence, if any, concurrently.

(Veloso DID HAVE a reptile importing license from 2010 to 2014, as "Xtreme Reptiles", but he failed to renew his license and paid no taxes on his current reptile business.)  Veloso was "shipping large quantities of reptiles on a weekly basis." He made about $150,000 per year on his illegal reptile business, selling reptiles "in bulk" to pet stores around the country.  


↧

SMS Phish? Amazon Reward!

June 1, 2019, 12:12 pm
$
0
0
Are you getting text messages about winning prizes at Amazon?

I got one today with the following text from a VOIP-to-SMS number: 1 (410) 200-910

The text was:
 "FRM: You have a New Amazon Reward! MSG: http://dmkr3h.com/njngyw"

I threw up a Virtual Machine to check the destination, and got a meaningless echo of the domain name:



The problem, of course, was that they knew I was supposed to be on a cell phone, since they sent me an SMS.  No problem.  Let's make my Windows Chrome Browser a Cell Phone: 

Ok.  Now I'm a Firefox browser on an Android Mobile phone.  Let's try again.  Much better!  The CloudFlare hosted "dmkr3h" now forwards me to "simple-clubs.com" which is a CNAME alias to "seempts-explegal[.]com (35.169.148.30) " which passes my origin and affiliate data to chargingmilkshop[.]com (51.75.46.9), which forwards me to "winopinions[.]com (51.75.46.11)" which shows me this!


Before I take my Survey, I hit my "Back" button, just to see what happens, because often there are traps about such things.  Sure enough, hitting the "Back" took me to an ad totally unrelated to my Amazon Prize:


As much as I'd like to be Ketogenically Accelerated, I decided to go back to my original URL from the phone.  This time I landed at "ZoneOpinions[.]com" instead of WinOpinions, but since I was still on the same IP address, I decided to keep going and take the survey this time.  Here are my five Survey Questions:






OK, now for the excitement!  My big Amazon Reward is about to be revealed, right?





Hmmm... do I want a larger penis, a flatter belly, or a $780 watch?  I think I'll take the $780 watch, since its free and all ... 

Each time I click "Claim Reward" I get sent through a "1592track[.]com" redirector:
Which then forwards me to one of its randomly selected possible fulfillment domains ... 

getemergencygear[.]com
Odd.  Clicking on the watch takes me to a site for a free Tactical Flashlight. Oh well.  The point of this exercise is to feed some of my spam traps anyway.  We'll give them one of our spam trap email addresses just to see what they begin spamming to me. 

I wonder if ClickBank is complicit in these scams?
Since I'm not actually going to give them my credit card information, I'll see whether I get the same spam by submitting my address info for CBD Oil and Male Enhancement anyway.  Where do those clicks take me?
tryhealthoffer [.] com 


(a closer look at the Affiliate ID = 600080)

healthchoicev2 [.]com selling Primacin XL 


I saved which Spam Trap email I fed to each of the sites above.  If I start getting spam on them (none of them have existed before an hour ago and have never received any message prior to being fed to these sites) I'll do a follow-up post.

While trying to decide if this is something to share with my friends at the Federal Trade Commission, I decided to check what country these domains are hosted in ... Poland ... 

ipinfo.io/51.75.46.9 ==> OVH SAS in Poland.
According to the very useful tool at RiskIQ, it looks like 77 new domains stood up on this IP address about two days ago:
https://community.riskiq.com/search/51.75.46.9
We went ahead and exported that list so we could save a record of what other domains were there.  Looks like there are MANY alternative domains for doing the same sort of things ... 


resolvefirstSeenlastSeen
actionopinion.com5/30/20195/31/2019
airopinions.com5/30/20195/31/2019
alertandfocusednow.com5/30/20195/31/2019
alertandsharp.com5/30/20195/31/2019
blazingtea.com5/30/20195/31/2019
brainexpandnow.com5/30/20195/31/2019
brainexpandtoday.com5/30/20195/31/2019
brainexpandtonight.com5/30/20195/31/2019
cellopinion.com5/29/20195/31/2019
centeropinion.com5/30/20195/31/2019
chargingmilkshake.com5/30/20196/1/2019
companyopinions.com5/30/20195/31/2019
connectexclusive.com5/25/20195/31/2019
corpprogram.com5/30/20195/31/2019
dataopinions.com5/30/20195/31/2019
dreamopinions.com5/30/20196/1/2019
exclusivetrendingreport.com5/25/20195/31/2019
fitketonow.com5/30/20195/31/2019
fitketotoday.com5/30/20195/31/2019
fullyhardagain.com5/30/20195/31/2019
fullyhardtonight.com5/30/20195/31/2019
hardandlongagain.com5/30/20195/31/2019
hardandlonger.com5/30/20195/31/2019
hotbreakingreports.com5/30/20195/31/2019
hotnewstonight.com5/30/20195/31/2019
hotviralreports.com5/30/20195/31/2019
latestbreakingreport.com5/30/20195/31/2019
latestviralreport.com5/30/20195/31/2019
learningopinion.com5/30/20195/31/2019
lineprogram.com5/30/20195/31/2019
linkopinions.com5/30/20195/31/2019
linksprogram.com5/30/20195/31/2019
longandhardagain.com5/30/20195/31/2019
longandhardtonight.com5/30/20195/31/2019
longerhardernow.com5/30/20195/31/2019
lookprogram.com5/30/20195/31/2019
lumberingsoda.com5/30/20195/31/2019
magicopinions.com5/30/20195/31/2019
matchopinion.com5/30/20195/31/2019
maxopinions.com5/30/20195/31/2019
mindexpandnow.com5/30/20195/31/2019
monsterprogram.com5/30/20195/31/2019
newbreakingreport.com5/30/20195/31/2019
newbreakingreports.com5/30/20195/31/2019
newtrendingreport.com5/30/20195/31/2019
newtrendingreports.com5/30/20195/31/2019
newviralreport.com5/29/20195/31/2019
portalopinion.com5/30/20195/31/2019
projectopinions.com5/30/20195/31/2019
romanwatermelon.com5/25/20195/31/2019
rushingcoffee.com5/30/20195/31/2019
saveopinion.com5/30/20195/31/2019
shesreadytonight.com5/30/20195/31/2019
shoppingopinions.com5/30/20195/31/2019
slimketonow.com5/30/20195/31/2019
slimketotoday.com5/30/20195/31/2019
slimketotonight.com5/30/20195/31/2019
slowseltzer.com5/30/20195/31/2019
sluggishjuice.com5/29/20195/31/2019
sprintingspirits.com5/30/20195/31/2019
swiftespresso.com5/30/20195/31/2019
teamopinions.com5/30/20195/31/2019
thenewstrends.com5/30/20195/31/2019
tightketonow.com5/30/20195/31/2019
tightketotoday.com5/30/20195/31/2019
tightketotonight.com5/30/20195/31/2019
todaysbreakingstory.com5/25/20195/31/2019
tonightsbreakingstory.com5/25/20195/31/2019
totalbreakingnews.com5/30/20195/31/2019
touchopinion.com5/30/20195/31/2019
trendstonight.com5/30/20195/31/2019
whirlingmilk.com5/30/20195/31/2019
winopinions.com5/30/20196/1/2019
yournewsbreaks.com5/30/20195/31/2019
yournewstrends.com5/30/20195/31/2019
zoneopinions.com5/30/20195/31/2019
zoomingcider.com5/30/20195/31/2019

Many of these domains are proven to be interchangeable, as long as your user agent is right. Pasting the "path/file/parameters" from one site to another of the same type usually works.

Conclusion?  Don't think I'm going to get my Amazon Prize.  Darn.
↧
Search

TrickBot: New Injects, New Host

June 29, 2019, 7:23 am
$
0
0

What’s in the Name: Call it IcedID or TrickBot? Tell that to a security researcher (Arsh Arora in this case) and watch them RANT

(Gar-note: today's blog post is a guest blog from malware analyst, Arsh Arora...) 

Today’s post starts with an interesting link from Dawid Golak's Medium post: “IcedID aka# Bokbot Analysis with Ghidra” which mentions that IcedID is dropping TrickBot. Although the article is about IcedID, it gets confusing quickly, because the researcher focused on finding artifacts for IcedID instead finds TrickBot artifacts. A big question for the security industry still remain is to how to classify the malware from the originator or the binary that is being dropped. We followed up on the sample he mentioned and saw the same thing.  This is definitely Trickbot.

First Stage – Sample Collection from Virus Total Intelligence

In the "AnyRun Analysis" linked to by Dawid, the TrickBot binary was downloaded from “54.36.218[.]96 (slash) tin[.]exe


Virus total link (50/ 71 detections) https://www.virustotal.com/intelligence/search/?query=84878B4967A4243CD904794F3B8B2812

Fig 1: TrickBot Sample

Second Stage – Sample Execution

After the execution in a virtual environment, I was able to see TrickBot behavior similar to what we have documented in the past in our post "Trickbot's New Magic Trick: Sending Spam":

A large number of config files and dlls were loaded into the Roaming/netcache/Data, a  unique behavior of the TrickBot binary.

Fig 2: Configs and Dlls Loaded

Third Stage – Open Firefox and visit different Bank website

It is often the case that to get any banking trojan to co-operate with the researcher, some initiation from the researcher side is needed. Due to past experience, I have learned that one needs to open up a browser and visit different bank websites to activate the banking trojan. The trojan resists until instigated by visits to these pages. I visited close to 20 different bank websites and was able to obtain injects from 7 of those bank websites. The injects and admin login panels of the websites are as follows.

Name of  Bank
Admin Login Panel
IP
Location
Bank of
America
https://aefaldnessliverhearted[.]com/load/
185.242.6.245
AS9009, Prague
Chase
https://aefaldnessliverhearted[.]com/load/
185.242.6.245
AS9009, Prague
Citi
https://remirollerros[.]com/legr/
109.234.37.246
AS48282, RU
Usaa
https://onlylocaltrade[.]com/lob.php
185.87.187.198
AS48635,NL
WellsFargo
https://wellsfargostrade.com/2wells2
185.36.189.143
AS50673, NL
PNC
https://wellsfargostrade[.]com/pncadmin/index.php
185.36.189.143
AS50673, NL
53 Bank
https://wellsfargostrade[.]com/53repadmin2
185.36.189.143
AS50673, NL

When infected, viewing the source code while visiting one of the banks is all that is needed to identify the data exfiltration destination.  Some examples follow from this infection run:

BankofAmerica

Fig 3: BoA Web Inject

Chase

Fig 4: Chase Web Inject

Fig 5: BoA and Chase Admin Panel

Citi

Fig 6: Citi Web Inject

Fig 7: Citi Login Panel

USAA


Fig 8: USAA Web Inject

WellsFargo

Fig 9: WellsFargo Web Inject

Fig 10: WellsFargo Admin Panel

PNC

Fig 11: PNC Web Inject

Fig 12: PNC Admin Panel

53 Bank

Fig 13: 53 Bank Web Inject

Fig 14: 53 Bank Admin Panel


For more details please contact Arsh Arora (ararora at uab.edu) or Gary Warner (gar at uab.edu) at UAB. Please note:  Arsh is defending his PhD this summer and looking for new opportunities.


↧
↧

FinCEN: BEC far worse than previously believed

July 23, 2019, 5:27 am
$
0
0
Last week FinCEN, the Financial Crimes Enforcement Network, put out a new advisory with information about Business Email Compromise and it is far worse than has been previously disclosed.
FinCEN Advisory: FIN-2019-A005

The FBI's Internet Crimes Complaint Center (IC3.gov) has previously called BEC a $12 Billion Scam.  As we shared in April in our post IC3.gov: BEC Compromises and Romance Fraud 2018, IC3.gov documented that during calendar 2018 $1.2 Billion was stolen from 19,140 companies just in the United States.  That averages out to $3.3 Million being stolen each day with 52 U.S.-based businesses falling victim each day.  But the IC3.gov reports are based on actual reports received from victims who fill out a Complaint Form on the IC3.gov website. We strongly encourage victims to report at IC3.gov, as it offers the ability to provide many additional investigative details.

Victims are STRONGLY encouraged to report at IC3.gov! 
The FinCEN approach was able to use a different intelligence source to gather their numbers and what they found was far worse than what the FBI has reported.  From October 2013 until May 2018, the FBI's IC3.gov gathered reports of $12 Billion in fraud, from all sources, both domestically and internationally.   FinCEN's previous BEC advisory shared that from 2013 to 2016, FinCEN had identified 22,000 cases of Business E-mail Compromise and E-mail Account Compromise with $3.1 billion in losses, or roughly $1 Billion per year.  The September 6, 2016 advisory was "Advisory to Financial Institutions on E-Mail Compromise Fraud Schemes [FIN-2016-A003]".  FinCEN's current advisory states that the new information is complementary to the 2016 advisory, and that the 2016 advisory contains many important details that will still be helpful to consumers and business account holders alike.

United States Businesses and Consumers have suffered $9 Billion in BEC Fraud Attempts since September 2016!
By comparison, FinCEN reports that  JUST SINCE September 2016 they have been able to document 32,000 cases of attempted theft via BEC fraud schemes totaling $9 Billion in theft attempts.  The rate of loss has increased by three-fold!  $9 Billion since September 2016 is approximately $8.7 MILLION DOLLARS PER DAY!!!

Some of the current top trends include:

Top Sectors Targeted in BEC:

1. Manufacturing and construction (25% of all cases)
2. Commercial services (18% of all cases)
3. Real Estate (16% of all cases)

The impersonation of top executives is still a major method of social engineering in these email attacks.  50% of attacks use an email claiming to be a CEO or President of the company.

Other Top Targets by Value in BEC: 
1. Governments - many governments have been targeted, especially small municipal government offices.  Targets often include pension funds, payroll accounts, and contracted services (which may be matters of public record.)  Vendor impersonation in the latter case is especially prevalent.

2. Educational Institutions - Just in 2016 - 160 incidents attempted to steal $50 million from educational institutions, and while in 2017, only 2% of attacks were against schools, the dollar value was far higher than average.  Tuition payments, endowments, grants, and renovation and construction costs are all high value transactions often conducted online.  Again, watch for vendor impersonation! Large-scale construction and renovation projects are often publicly announced, attracting scammers to the same projects.

3. Financial Institutions - while not a high percentage by sector, the attempted theft against FIs themselves often includes very high dollar values.  These often come in the form of SWIFT payment requests (used in international wire transfers.)

The First Hop is Domestic
While previous advisories mentioned that money is often sent overseas, it is important to understand that the INITIAL transfer of funds will likely stay domestic.  A person recruited as a money mule will often have opened the intermediary account in their own name or the name of a fraudulent business they have created for the purpose.  AFTER the first hop, the money still is likely to quickly move to China, Hong Kong, the United Kingdom, Mexico, or Turkey.  Often these money mules are recruited through Romance Scams, however others join willingly knowing they are going to earn a commission helping to launder money for criminals.  This quick "wire in - wire out" is referred to in the criminal world as "wire-wire jobs" and is the inspiration of the FBI and USSS's "Operation: Wire Wire" that we blogged about in a series of articles in June of 2018:
One other blog post of ours that "walks through" a case, end-to-end, including the mule's role:
Vulnerable Business Processes Compromised
FinCEN states that "BEC perpetrators identify processes vulnerable to compromise, whether through openly available information about their targets or through cyber-enabled reconnaissance efforts (enabled through methods such as spear phishing or malware), and then insert themselves into communications by impersonating a critical player in a business relationship or transaction."

These scams are enabled by "weaknesses in the victim's authorization and authentication protocols." 

The most common type of scam simply involves a request to change the payment destination of an already approved transaction.  If your business would allow someone to change where a six- or seven-figure payment is being sent on the strength of a single email, you are far more likely to be chosen as a victim than someone who requires rigorous vetting of such a change.

Opportunities for Information Sharing Related to BEC Fraud
The USA PATRIOT Act provides the ability for financial institutions to share information with one another to stop money laundering.  These requests are known as 314(b) requests and are specifically protected forms of information sharing.  (Fun fact: Did you know USA PATRIOT is an acronym?  "Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism.")  Click the image below to download the FinCEN 314(b) Fact Sheet.

https://www.fincen.gov/sites/default/files/shared/314bfactsheet.pdf

WHAT SHOULD WE SHARE?

If you are asked to wire funds or change a payment destination or otherwise gain information about a BEC Scam, FinCEN shares particular information about what details would be most helpful to law enforcement: 

Transaction details: 
1) Dates and amounts of suspicious transactions; 
2) Sender’s identifying information, account number, and financial institution; 
3) Beneficiary’s identifying information, account number, and financial institution; and 
4) Correspondent and intermediary financial institutions’ information, if applicable. 

Scheme details: 
1) Relevant email addresses and associated Internet Protocol (IP) addresses with their respective timestamps; 
2) Description and timing of suspicious email communications and any involved compromised or impersonated parties; and 
3) Description of related cyber-events and use (or compromise) of particular technology in the conduct of the fraud. For example, financial institutions should consider including any of the following information or evidence related to the email compromise fraud: 
  • a) Email auto-forwarding 
  • b) Inbox sweep rules or sorting rules set up in victim email accounts 
  • c) A malware attack 
  • d) The authentication protocol that was compromised (i.e., single-factor or multi-factor, one-step or multi-step, etc.)
For those who have the ability to file a SAR (a Suspicious Activity Report), FinCEN also requests that you choose SAR Field 42 (Cyber Event) for all of these scams, but then mark the scam with the key terms either "BEC FRAUD" or "EAC FRAUD" to differentiate between business victims and personal account victims.  Here is their guidance on both terms:

Email Compromise Fraud: Schemes in which 1) criminals compromise the email accounts of victims to send fraudulent payment instructions to financial institutions or other business associates in order to misappropriate funds or value; or in which 2) criminals compromise the email accounts of victims to effect fraudulent transmission of data that can be used to conduct financial fraud. The main types of email compromise, the definitions of which have been modified to reflect the expansion of victims being targeted, include: 

Business Email Compromise (BEC): Targets accounts of financial institutions or customers of financial institutions that are operational entities, including commercial, non-profit, nongovernmental, or government entities. 

Email Account Compromise (EAC): Targets personal email accounts belonging to an individual.


↧

Lauded Nigerian Entrepreneur may be a BEC Yahoo Boy

August 18, 2019, 4:15 pm
$
0
0

Obinwanne Okeke: The Entrepreneur

Obinwanne Okeke, 31 year old CEO and Founder of Invictus Group, is frequently lauded as a success story.  At age 28, Forbes Africa featured him in their June 2016 issue under the title "Africa's Most Promising Entrepreneurs: Forbes Africa's 30 Under 30 for 2016".

Although the 30 are "in no particular order", Obinwanne was one of the two selected to appear on the cover of that month's Forbes Africa:

The Forbes profile described Okeke like this:
Okeke could not fail his mother. A promise meant hard work and dreaming big.  He was raised in Ukpor village, 790 kilometers from Nigeria’s capital, Abuja, as the 17th child of a polygamous father. He went to boarding school aged 10, lost his father at 16 and moved from one relative to another. He named his company Invictus after one of Nelson Mandela’s favorite a poems, by William Ernest Henley, about the undefeated and unconquerable soul of a hard worker, from an impoverished background, who will not give up.
Invictus is in construction, agriculture, oil and gas, telecoms and real estate. He has 28 permanent and 100 part-time employees across nine companies.
He was also selected to speak at the Lagos TEDx Yaba conference, where his topic was "DNA of the Nigerian Entrepreneur ... The Resilience Needed" (photo from his company website - invictus.com.ng): 

Invictus.com.ng

Obinwanne also was featured on Forbes'"YoungMoney" ... and the BBC's "Rising Star" ...

Full interview at BBC Africa's Facebook page
The BBC interview gave some of Obi's background.  He says that he started an IT company at age 16 while still in the village, printing business cards and making websites.  With this money he bought the finest bicycle in the village. Later, he was accepted to study at Monash University, where he studied International Business and Counter-Terrorism.  He says that he was fascinated with Criminology, which is interesting in hindsight.

Obinwanne Okeke: The BEC Criminal / Yahoo Boy


According to court records available on PACER, Okeke was arrested in Dulles, Virginia on August 6, 2019.  Let's just walk through the Criminal Complaint that was used to justify the arrest warrant:

Okeke was charged with Conspiracy to Commit Computer Fraud and Wire Fraud. (18 USC section 1030 and 1349.)  

In June 2018, Unatrac Holding Limited, the export sales office for Caterpillar heavy industrial and farm equipment, headquartered in the UK, contacted the FBI, reporting that Unatrac ad been scammed out of $11 Million USD.  Unatrac's Chief Financial Officer fell for a phishing email that contained a login link to a fake Microsoft Office365 website.  When the CFO entered his userid and password, it was sent to the criminals.  Between April 6 and April 20, 2018, the CFO's account was logged into from IP addresses mostly in Nigeria on 464 different occasions.

One key behavior of recent BEC scams was also present in this one.  On seven different occasions, someone modified Outlook Office365 rules to intercept legitimate emails to and from employees on the financial teams, mark them as "read" and move them to another folder outside the in box.  The complaint says "These rules appeared to have been created in an attempt to hide from the CFO any responses from the individuals to whom the intruder was sending fabricated emails."

With full access to the CFO's accounts, the intruders stole invoices, invoice templates, and logos, and used them to create fraudulent invoices, sent from external addresses to the CFO, and then forwarded "by the CFO" to the financial team for payment.  One such example email was received on April 19, 2018 from pakfei.trade@gmail.com.  The email was forwarded two minutes later to the finance team with instructions to pay.

From April 11 through April 19th, they paid 15 fraudulent payments, included three invoices for "Pak Fei Trade Limited" in the amounts of $278,270.66, $898,461.17, and $1,957,100.00.  Altogether, $11 million USD was sent out of the company.

Documents related to the CFO's travel schedule and the companies tax filings were also stolen, forwarded to the email address "iconoclast1960@gmail.com."  WHOIS queries run by the FBI indicated that the email address was used to create fraudulent "clones" of real companies websites.  One example they give is of "emmarlndustries.com" -- where the "I" in Industries is actually a lowercase "L".  The real company is a domain owned by ASM International Trading in Dubai.  Other domains, not mentioned in the affidavit, but also registered by this address, include "hmlsho-group.com" and "western-chem.net" and ".com".

Search warrants for the email addresses of iconoclast1960 revealed additional frauds, including a $108,470.55 payment received by the Red Wing Shoe Company in Minnesota.  They were victimized in a very similar way.  More than 600 additional phished userids and passwords were recovered in the gmail, along with photos of passports and driver's licenses.  

Chats between iconoclast1960 and others dating from December 2017 to November 2018 reveal the scammer interacting with people who are making his phishing sites for him, including a Docusign phishing site.  The iconoclast1960 email account also sent and received emails containing phishing kits, such as one called "microsoft.zip" where the file "verify.php" contained code to email stolen credentials to a redacted email address.

The iconoclast1960 gmail account used a recovery email address of "alibabaobi@gmail.com".  This address shared a login session cookie with several additional accounts, including "obinwannem@gmail.com".  This means that the person who logged in to Gmail as "alibabaobi" had also logged in to Gmail, from the same computer, using the Gmail account "obinwannem".  

The Obinwannem gmail account also belongs to the Nairaland.com user "InvictusObi" and to the Twitter user "@invictusobi."  The Twitter page provides repeated links to an Instagram account for InvictusObi as well.  Both the Twitter and Instagram page provide many proofs that these accounts belong to Obinwanne Okeke, the CEO of Invictus Group.

Gmail, Twitter, and Instagram all log the IP addresses from which users access their accounts.  When Okeke posted on Instagram that he was visiting Seychelles, Google's logs showed that iconoclast1960@gmail was logging in from 197.157.125.89, in Seychelles.  When Okeke was posting on Instagram that he was visiting London on April 20, 2018, the iconoclast1960@gmail account was logging in from 167.98.28.227.  When Okeke said he was visiting the United States, specifically Washington, DC, the iconoclast1960@gmail account was logging in from 68.33.78.173, a ComCast IP address in Washington, DC.

For further evidence, Okeke posted information that he had been hospitalized following a recovery from surgery.  The FBI agents searched the Google chat logs for Iconoclast1960 and found that he was mentioning in the chats "ive been in hospital. im back in nigeria but still resting.


The FBI agent also found multiple instances where the iconoclast1960 gmail account forwarded emails with attachments to the invictusobi@icloud.com account.  Search warrants were also conducted for that account, as well as obinwannem@gmail and alibabaobi@gmail.

Searches through older FBI case files show additional previous frauds conducted in the same manner using the same email addresses, dating all the way back to 2015.  

The FBI agent ended his affidavit by showing that Obinwanne Okeke has a Nigerian Passport A50254005 and uses a Visa for entry to the United States "once or twice a year."  He was currently in the country, scheduled to depart on August 6, 2019.  

Presumably that is how they knew where to find him at Dulles Airport in Virginia to arrest him as he attempted to leave the country.  That must have been a nice collar for the FBI agent who had spent all that time investigating to be able to pick him up in person!




↧

Los Angeles Court charges 80 Nigerians with BEC and Romance Scam Crimes

August 24, 2019, 11:25 am
$
0
0

Bank of America, BBVA Compass, CalCom FCU, Capital One, Citibank, Citizens Bank, Comerica, Chase Bank, PNC Bank, Regions Bank, SunTrust, TD Bank, US Bank, and Wells Fargo Bank were among the financial institutions who were scammed by the 80 Nigerian criminals named in a Los Angeles indictment unsealed this week.  In this blog post, we'll introduce the case and share the first six of thirty victim stories that we'll continue over the next several posts.

FBI Los Angeles Technology Enabled Crime Task Force
In a press conference on August 22, 2019, the FBI Los Angeles Technology Enabled Crime Task Force shared a poster of the 16 Los Angeles residents charged in the case, 14 of which have already been captured.  Others residing in the US named in the case included residents of Houston, Texas, Orlando, Florida, Sacramento, California, Boston, Massachusetts, and Atlanta, Georgia.

According to the indictment, between October 7, 2014 through May 2, 2018 the 26 criminals charged in Los Angeles participated in mail fraud, bank fraud, and wire fraud by "transporting, transmitting, and transfering funds from place in the United States to a place outside the United States,"  "conducting and attempting to conduct, financial transactions, affecting interstate and foreign commerce," and ... "knowing that the property involved in the financial activity represented the proceeds of unlawful activity, and knowing the transactions were designed in whole and in part to conceal and disguise the nature, location, source, ownership, and control of the proceeds." They are also charged with "engaging and attempting to engage in monetary transactions involving criminally derived property of a value greater than $10,000, affecting interstate and foreign commerce."

Title 18 Section 1343 (wire fraud)
Title 18 Section 1341 (mail fraud)
Title 18 Section 1344(2) (bank fraud)

There are SO MANY STORIES to be told out of this indictment and the corresponding criminal complaint that it might take several days to get through them all.  The criminal complaint shares the details of thirty separate scams that are all connected, primarily via the two primary defendants, Valentine IRO and Chukwudi IGBOKWE.  Because of that, let's start with their first formal encounter with Law Enforcement on this case.

The July 19, 2017 Search Warrant (IRO, IGBOKWE, EROHA)

On July 19, 2017, the FBI served a search warrant at the residence of Valentine IRO's apartment. Having received no answer to their repeated loud knocking, they opened the door with a key provided by the landlord.  The reason no one was answering the door was because the residents were busy trying to destroy evidence.  Chukwudi IGBOKWE slid one window open and threw two phones (a gold iPhone 7 Plus (+1.323.509.0012) and a silver/white Samsung Galaxy Note 5 (+1.213.425.8827)) as far as he could, landing on the curb of the driveway to the apartment.  Meanwhile Chuks EROHA was throwing another cell phone (a black iPhone 7 Plus, +1.310.406.9386) into the yard of a neighboring property through another window.  While they were throwing phones out windows, someone else was trying to destroy a gold Samsung Galaxy (+1.424.2887.9250), which was found hidden under IRO's bed, bent nearly in half with a shattered screen, and damaged circuit boards and battery.  Other phones (a blue Samsung, +1.424.368.0611 and a sliver iPhone 6S Plus (+1.310.626.7033 / WhatsApp +234.816.165.6787) and tablet computers were also found in the search. 

During the ensuing interview, IRO admitted to using the email accounts "enterpriseiro@gmail.com" and "valentino_q2000@yahoo.com" as well as controlling the bank accounts of the fraudulent companies "VOI Enterprises" at Chase Bank and "Irva Auto Sales" at Wells Fargo.  He claimed to have broken the phone after a fight with his wife, who he said was angry about him video-chatting with another woman.  This was one of several provable lies in the interviews. Data from IRO's broken phone was forensically recovered by the FBI Laboratory in Quantico, Virginia, which must have been quite a challenge, but was successfully accomplished!  The phone was used to receive messages 38 seconds and 39 seconds after the FBI hit the front door, which proves he had not destroyed it the previous day, as claimed.   EROHA also swore he had not thrown any phones.  IGBOKWE claimed he did not know anything about the fraud but that he did help his "wife", Tityaye MANSBANGURA, with her business of buying and selling cars.

(IRO was previously interviewed by the FBI on October 26, 2016 and November 23, 2016 about a wire transfer of $100,083.45 that was sent by a German victim company to his Chase VOI Enterprises account.)

A key finding in the phone reviews was that these guys NEVER DELETE DATA!  Three phones retrieved in the search warrant in contained Facebook Messenger messages dating back to March 2014, April 2012, and even 2010!  WhatsApp messages on one phone were as old as July 2015.

The ring-leader defendants, all found in the same apartment that morning in July 2017, IRO, IGBOKWE, and EROHA  would provide bank accounts to most of the others charged in this case, including: UMEJESI, OGUNGBE, EKECHUKWU, XPLORA G, OCHIAGHA, N. DURU, OFORKA, MARK CHUKWUOCHA, NNAMDI, CHILAKA, OHAJIMKPO, UCHE, ODIONYENMA, OGBONNA, ONWUASOANYA, MACWILLIAM CHUKWUOCHA, UZOKA, AWAK, EGWUMBA, EZIRIM, OKAFOR, SAM MAL, MBA, IKEWESI, OGANDU, ANYANWU, AZUBUIKE, NWACHUKWU, IZUNWANNE, OSUJI, ONYEKA, ANUNOBI, OKOLO, ONUWA, ISAMADE, MADUFOR, NNEBEDUM, OKEREKE, ODIMARA, ONUDOROGU, NZENWAH, OBASI, AGUBE, OKORIE, OHIRI, UGWU, AGWUEGBO, CHUKWU, MEGWA, IWU, CHIKA, MEZIENWA, AGUH, ESHIMBU, ANOZIE, AGUNWA, G. DIKE, UKACHUKWU, OSMUND, NWANGWU, AJAH, EJIOFOR, UBASINEKE, IBETO, NWANEGWO, E. DIKE, EKI, IWUOHA, C. DURU, and IHEJIUREME "into which they could fraudulently induce a victim to deposit funds from a BEC fraud, escrow fraud, romance scam, or other fraudulent scheme."

 UMEJESI, CATHEY, MANSBANGURA, AJAEZE, EKECHUKWU, OJIMBA, ISAMADE, and P. DURU, played roles in "opening or causing to be opened" new bank accounts.

 To do so, they would first file a "false and fraudulent Fictitious Business Name Statement" with the Los Angeles County Registrar-Recorder at the County Clerk's Office.

The list of 80 charged individuals is at the end of this post, but for now, let's jump straight to some of the stories of Business Email Compromise and Romance Scams that brought together this international gang of thieves.

Victim Company 1 - September 2014

A San Diego County distributor of clothes was communicating with a Chinese vendor about an order of men's shirts.  By hacking an email account at one of the companies, a fraudster implemented mail rules to block the real emails and injected himself into the middle of the communications.  The scammer caused the payment account for an invoice to be changed, resulting in a wire of $45,783.97 going to an HSBC Bank account (6100) controlled by scammers.

IRO (valentino_q2000@yahoo.com) and ONWUASOANYA (samuelnnamdi@rocketmail.com) communicated via Yahoo instant messenger about their roles in the chat, including sending a "cut and paste" email Onwuasoanya could use to forward to the victim company.

Personal Romance Scam Victim #1: M.S. 

M.S. a 61-year old woman in Monterey Park, California fell victim to a Romance scam on Facebook.  In May 2015, she met "Dennis Hunt" (his Facebook name) who claimed to live in London and work in real estate construction.  He communicated with M.S. via Facebook messenger and two +44 (UK) telephone numbers.  M.S. loaned "Dennis Hunt" money for a new project, which totaled $111,200.  $91,200 was sent to IRO's Chase account in the name "VOI Enterprises" which attempted to disguise the money by claiming to be dealing in used automobiles.

 Sep 3, 2015: OI ENTERPRISES acccount opened: Chase 9837
 Sep 3, 2015: $23,000 sent from MS BOA Account to IRO's Chase 9837
 Sep 4: 2015: $14,000 withdrawn from Chase 9837 memo "for Lexus RX330 and RX300"
 Sep 4, 2015: $1500 sent to relative from Chase 9837 memo "2002 Nissan Optima"
 Sep 8, 2015: $46,500 sent from MS BOA account to Chase 9837 account
 Sep 8, 2015: $8,000 withdrawn from Chase 9837 memo "Mercedes 2011 and Lexis RX 350 2008"
 Sep 10, 2015: $30,000 withdrawn from Chase 9837 memo "for Acura MDX 2007"
 Sep 10, 2015: $9,000 withdrawn from Chase 9837
 Sep 10, 2015: $4,700 sent from MS BOA Account to IRO's Chase 9837
 Sep 11, 2015: $7,700 check sent from Chase 9837 to a friend memo "Camry 207 and Camry 05"
 Sep 14, 2015: IRO sends OGBANNA instructions to have MS wire a payment "Invoice number: VOI00462 R MODEL 89"
 Sep 14, 2015: $17,000 sent from MS BOA to Chase 9837 memo "Invoice number: VOI 00462 R MODEL 89"
 Sep 17, 2015: $10,000 withdrawn from Chase 9837
 Sep 17, 2015: $20,000 withdrawn from Chase 9837
 Sep 17, 2015: $5,000 withdrawn from Chase 9837

 Victim Company 2 - February 2016 BEC Fraud

A company in Texas was tricked into sending $186,686 from its account at UBA to IRO's Chase VOI Enterprises account.  The company had ordered some oil extraction equipment and was sent bank account information as to where to send the funds.  A few hours later, the Texas company received new communications, indicating the previous banking details were incorrect and providing new account information.  (The new email's headers reveal they were sent from Nigerian IP addresses.)

 Feb 12, 2016 $186,686 from United Bank of Africa account to IRO's Chase 9837 Account
Feb 16, 2016 $132,950 wired from that account to Wells Fargo "Irva Auto Sales Account" memo "Mack Rd Model 2010 X"
Feb 16, 2016 $50,000 send from Wells Irva Auto to BOA account 1824 "Bernards International"
Feb 18, 2016 IRO withdrew $50,000 cash from BOA 1824.
Feb 18, 2016 IRO wires $30,500 to Chase 1279.
Feb 16, 2016 $28,670 wired to CalCom FCU account 3017 memo "Menhien Auction on Wednesday"

(The Texas company recovered $55,593.18 of that amount, but only after spending $50,000 in legal fees pursuing the matter with Chase.)

Personal Romance Scam Victim 2 - R.B. 

R.B. was a 48 year old woman living in Panama City Beach, Florida who was recently widowed.  She began an online romantic relationship with a doctor in the US Military, stationed in Libya, who was a widower.  He claimed to have a five year old daughter and that his parents were killed in the Twin Towers attacks on 9/11. 

R.B. sent three wires from her Wells Fargo account
Mar 31, 2016 - $18,000 to the Comerica account 2663 of IRVA Auto Sales
Apr 4, 2016 - $39,000
Apr 7, 2016 - $30,000

Several cash withdrawals were made from Nashville, Tennessee from the Comerica account.  $55,024.19 of the total amount was frozen by Comerica and returned to R.B., who reports that she considered suicide when learning she ahd been scammed.

IRO discussed his fraud against R.B. using his email enterprisesiro@gmail.com.  AWAK created false invoices to help launder the funds from the Auto Sales account.  ODIONYENMA emailed IRO a photograph of the wire transfer, including R.B.'s transfer request and her Florida driver's license number, address, phone number, and Wells Fargo bank account details.  AWAK also communicated about laundering these funds using the name "HANOI BATTERY JSC" and the email ccs03h@gmail.com.  AWAK also used the name "Kwee Tin Law" with that email address.  He provided invoices for IRO to use, one of which used IRO's residential street address (412 Gina Dr., Carson, California) with the name "IRVA Auto Sales Equipment Broker LLC."

Personal Romance Scam Victim 3 - F.K. 

F.K. was a Japanese woman who became involved in a 10-month online romance scam. She believed she was "dating" Terry Garcia, a US Army captain stationed in Syria.  They met on "InterPals" and communicated almost daily via Garcia's Yahoo email address.  They communicated in English, which F.K. used Google Translate to assist with.  Eventually, Garcia was wounded in Syria, but his friend Collins Coster, a Red Cross employee, had been given a box of diamonds with instructions that Garcia wished them to be sent to F.K.  Owen Blair, the shipping consignment officer, contacted F.K. to arrange the payments for the customs fees for the box of diamonds.  Unfortunately, another fee was required for the diamonds to enter customs in Japan.  Diplomat Romain Kaufman helped her arrange, via gmail, her "diplomatic consignment tax" of $28,750.  F.K. continued to make various payments as the crazy scheme escalated.  She received emails as often as ten to fifteen times per day, and made "35 to 40 payments" which caused her to need to borrow many from friends, her older sister, her ex-husband, and even a bank loan.

F.K. paid:
April 11, 2016 - Western Union of $2000 sent to Turkey for "customs non-inspection fee"
April 11, 2016 - Western Union of $6,200 sent for "final accreditation fee"
late April - bank transfer of $28,750 sent to a bank in Turkey for "diplomatic consignment tax"
May 30, 2016 - Wire of $6,824.00 to Chase account 1577
July 13, 2016 - Wire of $33,128.26 to Chase account 0655

 Not only did she send $200,000 to the scammers, to bank accounts controlled by IGBOKWE and MANSBANGURA, she was also lured to Los Angeles for the purpose of convincing a bank to unfreeze her wire transfer!  She was told that a Russian bank manager in Los Angeles had embezzled the funds.  Defendants ANUNOBI was also involved in arranging some of this scam. 
On October 13, 2016, MANSBANGURA took photos of F.K. after meeting her at the airport and sent them to IGBOKWE saying "This is her" and later "I just drop her off. I'm not doing this again."

Personal BEC Victim 4 - J.G. 

J.G. was an attorney from Nevada.  A potential client "Frank Moss" claimed to have a construction company in Omaha, Nebraska, and needed J.G.'s help purchasing some equipment.  Moss said that he didn't want to make the purchase directly and needed the help of a lawyer to make the purchase.  Moss sent a check for $30,750 to J.G., who wired $30,000 to a US Bank account (2669) in the name M&F Enterprise.  Because J.G. had over $100,000 in his account, he didn't wait for the check to clear, which had a hold on it because it appeared to come from a Canadian bank.  Defendants MANSBANGURA and IGBOKWE were in control of the receiving account.

Oct 26, 2016 - $30,000 wired to US Bank 2669.
Oct 27, 2016 - $5,500 from that account paid to MANSBANGURA
Oct 27, 2016 - $7,850 from that account paid to an unindicted co-conspirator
Oct 28, 2016 - $8,845 from that account paid to an unindicted co-conspirator
Oct 31, 2016 - $7,500 from that account paid to MANSBANGURA

IGBOKWE sent several text messages from his iPhone 6S and Samsung phone sharing account details of the US Bank 2669 account to allow others to use it as well.

BEC Criminals Indicted in Los Angeles

In total, 80 individuals were charged.  In the list below, we've indicated those in the United States by placing *asterisks* around their number.  Many of the individuals in the Los Angeles area were brought into the case by exploring the chat logs and emails recovered from the phones on that initial search warrant and "spidering out" from there with additional records checks at Uber, Lyft, Google, Apple, Facebook, Microsoft, and Instagram.
*1*. VALENTINE IRO, aka “Iro Enterprises,” aka “Valentine Obinna Iro ,” aka ” Obinna Iro ,” aka ” Obinna Nassa,” - 424.287.9250 / 412 Gina Drive, Carson, California.
*2*. CHUKWUDI CHRI STOGUNUS IGBOKWE, aka ” Christogunus C. Igbokwe,” aka ” Chris Kudon ,” aka “Atete ,” aka “Still Kudon ,”
*3*. JERRY ELO IKOGHO , aka “J Man,” +1.323.308.0042 - in Valentine IRO's address book as "J.Man" - Confirmed via T-Mobile records, showing address 17630 Crabapple Way, Carson, CA 90746 - confirmed also by DMV records.  ikoghojerry@gmail.com also was registered to this telephone number, with recovery email ikoghojerry@yahoo.com.  The gmail and telephone were also used for accounts at Facebook, Uber, and Lyft.  Other numbers:  +1.646.651.6077.  Invited IRO to his 4th of July barbecue in 2017.
*4*. IZUCHUKWU KINGSLEY UMEJESI, +1.323.209.9682.  In IRO's Samsung address book as "Armenian Man".  In IGBOKWE's iPhone address book as "Kingsley LA".  In EROHA's phone as "Izuking Aka Aku."  Financial records give his address as 2319 W. Florence Ave, Los Angeles, CA.  Records tied to that number list his birthday, driver's license, and Nigerian passport number.  He also filed a police report using that name, telephone, and address after his Dodge Charger was broken into.  The number was also used by Uber, Lyft, Yahoo, and Facebook accounts.
*5*. ADEGOKE MOSES OGUNGBE.   IRO's Samsug gives +1.310.756.5633 as P&P Motors.  IRO also listed +1.310.773.8266 as "Pp." T-Mobile says OGUNGBE used the first number since April 3, 2012 at the street address 17260 Farwell St., Fontana, California.  His silver Lexus, registered to P/P Motors, LLC, was observed at that address.  That number was used in WHOIS data to register pandpmotorsllc with GoDaddy.com with the email adegoke101@gmail.com.  Google used the name "Moses Ogungbe" for that user, with the 5633 telephone.  The Instagram account "pandpmotors" used "Adegoke Moses Ogungbe" as the registered user.  Uber and Facebook also tie this user to the 5633 phone.  T-Mobile lists the 8266 number as his from Feb 6, 2016 to June 12, 2018.   P&P and PP both chat with IRO about personal matters, including referring from one phone number as saying "Na my second phone dey  my hand."
6. ALBERT LEWIS CATHEY.  IRO's Samsung has three numbers for CATHEY.  +1.323.359.5052 ("Alb"), +1.310.484.3117 ("Albert Jag"), and +1.310.242.0179 ("Al").  The 5052 number ties CATHEY to the phone in Inglewood, California from Oct 15, 2012 to June 28, 2017. His DMV records and Sprint records also tie him to the address.  His iTunes account gives his email as "ac.lu@aol.com" with the same Inglewood address.  His Apple account was later linked to "blueheaven3223@gmail.com" which he used to communicate with IRO.  "Albert Jag" and IRO spoke almost daily from Feb 17, 2017 to March 31, 2017, with less frequent comms starting in September 2016.   They discussed bank accounts in both India and China used in frauds.  The "0179" number was registered to CATHEY's girlfriend, with her addresses in Lawndale and San Pedro, California.  CATHEY opened a business bank account for a fictitious Ghanaian oil company for IRO, linked to the "3117" number.  The "0179" number is also used to open  two business accounts at Comerica Bank.
*7*. TITYAYE MARINA MANSBANGURA, aka “Tityaye Igbokwe ,” aka “Marina Mansour,” aka “Marina Mansaray,” aka “Marina Tityaye Mans Bangura."  MANSBANGURA used at least sixteen different telephone numbers to communicate with IRO, IGBOKWE, and EROHA between October 2016 and July 2017.  +1.310.279.0880, +1.310.527.1235, +1.310.806.3646, +1.310.904.3858, +1.310.904.8073, +1.310.920.7285, +1.310.920.8666, +1.310.447.4893, +1.424.376.4052, +1.424.376.7261, +1.424.376.7260, +1.424.305.9393, +1.310.954.6109, +1.424.376.9179, +1.424.376.9219, and +1.424.376.8558.   At one point when she began having trouble opening bank accounts ("All the banks have blocked me.") IGBOKWE told her that IRO knew someone who could get her a new passport and social security card "in four days."
*8*. CHUKWUDI COLLINS AJAEZE, +234.818.517.4075 was in IRO's phone as “Thank You Jesus.”  Tango, a messaging app, ties that phone to "Collins Eze 2" and the email "ajaeze@gmail.com".  Google records for that subscriber gave the name "Chuckwudi Collins Ajaeze" with the telephone +1.424.227.0030 and the recovery email "tm.haily10@yahoo.com".  That US telephone number is tied to many bank accounts, including a Chase account (0038) and a Wells Fargo account (1849).  Facebook, Uber, and Lyft all link the email to Ajaeze as well.  At least six bank accounts opened by AJAEZE list IRO's apartment as the address.  (Wells Fargo accounts 3087, 7748, 912, and 1849), Bank of America account (5957) and Chase account (0038).
*9*. EKENE AUGUSTINE EKECHUKWU.  +1.562.328.9622 was listed in IRO's phone as "Power" and in IGBOKWE's phone as "Ogedi Power."  IRO and Ogedi Power discussed problems with a wire transfer in a March 2017 chat.  ("What's your name? Ekenne Williams?" No. Ekene Ekechukwu.  "Ohhh! I gave them Ekenne Williams ... I made a mistake on your name!")  A Facebook account (Austine Dee) and an Instagram account (Austine) tie to the same number.  Uber and Lyft accounts for that number give the email "fatherkee@hotmail.com." Microsoft says that email belongs to "Augustine Ekechukwu."
10. CHUKS EROHA, aka “Chuks Nassa Iro,” aka “Nassa,” aka “Prince Chuddy,” aka “Nurse Chuddy,”
11. COLLINS NNAEMEKA OJIMBA, aka “Collins Emeka Ojimba,” aka “Ojimba Collins." IRO had +1.323.317.7383 in his Samsung phone listed as “Charly.Africa."  That number was in T-Mobile's records belonging to OJIMBA since June 4, 2011, with a Hawthorne, California address.  OJIMBA opened multiple bank accounts for IRO, including US Bank (1837) and Wells Fargo (7776), the latter in the name of "C and K Business Enerprise" [sic, "t" missing].
12. FNU LNU, aka “Xplora G,”
13. UCHENNA OCHIAGHA, aka “Urch Agu,” aka “Advanced Mega Plus Ltd,”
14. NNAMDI THEOJOSEPH DURU, aka “Duru Theo Joseph Nnamdi,” aka “Williams High School,” aka “Ifytyns,”
15. ERICSON UCHE OFORKA, aka “Oforka,” aka “Eric Oforka,”
16. MARK IFEANYI CHUKWUOCHA, aka “Mark Iheanyi Chukwuocha,” aka “Chukwu Mark,” aka “Markife,”
17. AUGUSTINE NNAMDI, aka “Nnamdi Augustine,” aka “Jazz,”
18. CHIEMEZIE CHRISTOPHER CHILAKA, aka “Fanta,”
19. CHARLES OHAJIMKPO, aka “Giggs,” aka “Ryan Giggs,” aka “Charles,”
20. STANLEY UGOCHUKWU UCHE, aka “Ugo Law,” aka “Uche Stanley,” aka “He is risen.Happy Easter!,”
21. CHIKA AUGUSTINE ODIONYENMA, aka “Tony Augustin Odionyenma,” aka “Chika Tony,” aka “CTA Finance Source Intl,”
22. PASCHAL CHIMA OGBONNA, aka “Chima,” aka “Paschal,”
23. SAMUEL NNAMDI ONWUASOANYA, aka “Sammy Lee Nnamdi,” aka “Onwuasoanya Samuel Nnamdi."  Sammy was in IRO's phone as “Enugu Ogo" with the number +234.816.505.6552.  Sammy's website was discovered which listed his birthdate and email "samuelnnamdi@rocketmail.com."  Yahoo (who owns RocketMail) lists Mr. Samuel Nnamdi as that account holder.  IRO's enterprisesiro@gmail.com corresponded with Nnamdi at that address, including wire transfer information and proofs of payment.  "Sammy Lee Nnamdi" was also listed in IRO's and EROHA's phones with the same number.
*24*. MACWILLIAM CHINONSO CHUKWUOCHA, corresponded with IGBOKWE using the name “ChiBoy" from the phone +1.407.233.7717.  He said he was in Orlando, Florida, when chatting from the same number to IRO.  He used his true name when opening an Orlando, Florida Wells Fargo account (5736).  T-Mobile indicates the number belonged to "Amcwilliam Chukwuocha" from November 25, 2016 to March 20, 2017.  IGBOKWE's other phone listed this number in its contacts as "Macwilliam" in his "imo" messaging application.  "imo" shows the account to use the email "macwilliam123chukwuocha@gmail.com" and the same telephone number.
25. EMMANUEL ONYEKA UZOKA.  IGBOKWE's phone listed UZOKA as "Mansion" (+1.470.338.6848) and also  “Son of God” (+1.646.457.6954). aka “Ezirim Uzoma").  IGBOKWE texted UZOKA and mentioned visiting Atlanta.  UZOKA provided his home address, 1405 Station Club Dr. SW, Marietta, Georgia 30060, which matches his driver's license address.  They discussed a $52,000 transfer in one chat.  T-Mobile ties the 6848 number to UZOKA at the same address.  UZOKA's Facebook and Instagram pages have photos matching ones he sent to IGBOKWE.
26. JOSHUA ANIEFIOK AWAK.  IRO's Samsung lists +234.808.0265.5259 as "Joe Awk".  He provided a Nigerian Guaranty Trust Bank account to IRO via chat, confirming he received a transfer.  The same number was on a business card AWAK provided to CBP when entering LAX airport following an inbound flight.  He told CBP he would be visiting IRO and provided two of IRO's telephone numbers to them, including the primary (+1.424.287.9250.)  Google has that number listed for "awak.joshua@gmail.com" with a recovery address of "joshuaawak@icloud.com."  Yahoo lists him as "joshuaawak@yahoo.com" with many telephone numbers and additional email addresses, including "ccs03h@gmail.com" which supplied the fraudulent invoice for victim R.B. above.  A Chase Bank investigator also provided the telephone number +1.786.872.2885 that linked AWAK to the email awak.joshua@gmail.com in their records.
*27*. GEORGE UGOCHUKWU EGWUMBA. IRO listed "George Ugo" as +1.714.916.1760, while EROHA had the same number as "Ugo Aunty Scholar."  Facebook ties the number to a "George Egwumba" account with the emails smillinggeorgeconsult@yahoo.com and egwumbag@yahoo.com.  Apple ties the number to the latter address, as well as "wingaldnigeria.ent@gmail.com".  A Nigerian telephone number, +234.803.374.3079, is also used in both Apple IDs.  The Yahoo id confirms the Nigerian telephone number, but also gives the name "Mr. George Bent."
28. UCHECHUKWU SOLOMON EZIRIM, aka “Uche Nwanne,” aka “Uche Ezirim,”
29. AUGUSTINE IFEANYI OKAFOR, aka “Zero,” aka “St.Austine,” aka “Austine,” aka “Ifeanyichukwu Okafor,”
30. FNU LNU, aka “Okay Sam Mal,”

31. LESLIE N. MBA, aka “Mystical,” aka “Nwachinemere Leslie,”
32. OGOCHUKWU INNOCENT IKEWESI, aka “Ogoo UK,” aka “Innocent Ikewesi,”
33. EMMANUEL UZOMA OGANDU, aka “Nwachinaemere,” aka “Uzoma,”
34. AMARACHUKWU HARLEY ANYANWU, aka “GodisGod,” aka “War B,”
35. BRIGHT IFEANYI AZUBUIKE, aka “Bright Bauer Azubuike,” aka “Ifeanyi Jnr,”
36. EMEKA MOSES NWACHUKWU, aka “All Man,” aka “Omalitoto,”

37. FNU LNU, aka “Donatus Izunwanne,” aka “Izunwanne Donatus Chibuikem,” aka “Deworlddonmax,”
38. CHINWENDU KENNETH OSUJI, aka “Father,”
39. EUSEBIUS UGOCHUKWU ONYEKA, aka “Ugo UK,” aka “sly19 sly,”
40. CHIDI ANUNOBI, aka “Anunobi Chidi,” aka “Chidioo,”
41. ANTHONY NWABUNWANNE OKOLO, aka “Eric West,” aka “Erci West,” aka “Code,”
42. OBINNA CHRISTIAN ONUWA, aka “Papa Chukwuezugo,” aka “Obinna Onuwa Abala,” aka “Obyno Abala,”
43.  CHIJIOKE CHUKWUMA ISAMADE, aka “Mr CJ,” aka “CJ,”  IRO's broken phone listed +1.415.530.9429 as "Cj" and had communicated with +1.707.490.1571.  The 9429 number was in IGBOKWE's phone as "Mr CJ." who was also listed as "Mr. CJ" with the Nigerian phone number +234.809.115.3589.  AT&T links the 9429 number to "Chijioke Isamade" in Sugar Land, Texas. He used the email "princeisamadecj@outlook.com" and "mrpincecj@icloud.com on two Uber accounts tied to the 1571 telephone number.
44. LINUS NNAMDI MADUFOR, aka “Madufor Nnamdi,”
45. CHRYSAUGONUS NNEBEDUM, aka “Cris,”
46. UGOCHUKWU OKEREKE, aka “Blade,” aka “Kingsly Cris,” aka “Okereke Ugochukwu,”
*47*. FIDEL LEON ODIMARA.  IGBOKWE listed +1.713.366.6633 variously as "Ndaa", "Fidel Odimara", "Dee Dutchman", "dutchman dee", "Ndaa USA", and "amusan olubunmi" in his various devices.   The T-Mobile records for the number tie it to "Fidel Odimara" at 10555 Turtlewood Court, Houston, TX 77072 since 21OCT2015.  Wallis State Bank had all of the same information listed for a business bank account in the name "General Auto USA."   Uber tied the phone number to fidelleo2005@yahoo.com, which Yahoo listed as "Mr. fidelo Jackson" with an alternate email of "generalegroup@yahoo.com."  That email had in turn the alternate email "generaloilservices@yahoo.com" in the name "Fidel Odimara."Instagram listed his account name as "De Dutchman" with the vanity URL /dedutchman, tied to the generalegroup@yahoo.com email address. 
48. KINGSLEY CHINEDU ONUDOROGU, aka “OBJ,”
49. DESSI NZENWAH, aka “Desmond Sage,” aka “Des Nzenwa,” aka “Saga Lounge,”
50. CHIMAROKE OBASI, aka “Chima Russia”
51. JAMES CHIGOZIE AGUBE, aka “Smart,” aka “Smart Agube,” aka “Smart Chigozie Agube”
52. CHIMAOBI UZOZIE OKORIE, aka “Omaobi,” aka “Mobility,”
53. OGOCHUKWU OHIRI, aka “Ogomegbulam Ohiri,” aka “Ologbo,”
*54*. KENNEDY CHIBUEZE UGWU, aka “Kennedy David,” was listed in IGBOKWE's phone as 1.781.654.5154, with additional numbers of +1.781.654.5154 and +1.347.393.1600, using the named "Kennedy", "Kennedy USA", and "Kennedy Ugwu."  The 5154 number was used in chats discussing payments with IGBOKWE, who stated that he lived in Brockton or Boston Massachusetts.  These phone numbers also were tied to the Facebook account for "Kennedy David."  "Northeast Security Inc" confirms that Ugwu was an employee and used a Brockton, MA street address, the 5154 telephone, and the email "kennedyugwu22@gmail.com" in his employment records.  his Facebook vanity URL was "kennedy.ugwu.7" and the same email given by his employer.
*55*. IFEANYICHUKWU OLUWADAMILARE AGWUEGBO.  IGBOKWE had AGWUEGBO in his phone as “B😎😎$$ IFF¥” with the number +1.401.536.0073.  A Wells Fargo investigator shows him using that number with the street address 8907 Deer Meadow Dr., Houston, TX 77071 to open an account ending in 2016.  He conducted at least five financial transactions related to this case, all using the same telephone and street address, including some using a Bank of America account (1769).
*56*. VICTOR IFEANYI CHUKWU. +1.323.237.4383 was listed in IGBOKWE's phone as "Vic,""Vic Chux", and "Anyi LA," in IRO's phone as “Ifeannyi Soccer,” and in EROHA's phone as "Ifeanyi."   In a text to IRO he says "my name is victor chukwu and I live in Los Angeles, California."  Chuckwu was interviewed by the FBI and provided an email "ifydiddy@yahoo.com" listed as belonging to Mr. Ifeanyi Chukwu, with the same phone.  Uber listed him as a driver, using that phone and the email "vic.chukwu@yahoo.com".  Lyft shows him as ifydiddy@yahoo.com. 
*57*. CHIDI EMMANUEL MEGWA.  IGBOKWE calls 1.754.213.6149 "Cantr,” in his contacts on one phone and "Canta Jr." with the number +1.682.414.1984 on another phone.  His Facebook account links him to emails "jaz_y2004@yahoo.com,""megwaemmanuel@yahoo.com," and "kodioluvsu@yahoo.com." Lyft has him listed as "Chidi Emmanuel" with the email "megwachidi@gmail.com" and after the 6149 number, also +1.682.347.0113.  His DMV photo matches images of him shared by SMS picturing him at a club with IGBOKWE and EROHA.
*58*. PRINCEWILL ARINZE DURU.  IGBOKWE had the number +1.916.997.9097 listed for DURU.  The two traded information about a Chase Bank account (2101), which Chase confirmed with this telephone number and the email princeeznira@gmail.com.  Sprint lists him as "Princewill Duru" in Carmichael, California.  Bank of America account (4859) in the name "PD Enterprise" showed DURU as the account holder with emails pdenterprise2017@gmail.com and princeduru22@yahoo.com.  Google lists a backup address for princeeznira as princeduru22@yahoo.com (in the name "King Eznira", which is "Arinze" spelled backwards, but also a pun on making "easy naira" (the currency of Nigeria.)
59. ESMOND IWU, aka “Desmond Chigozie Iwu,” aka “Lalaw,” aka “Odo Desmond,”
60. YEKA VINCENT CHIKA, aka “Chyco,” aka “Chika Ejima,” aka “Vincent Chika Onyeka,”
61FEANYI KINGSLEY MEZIENWA, aka “Ifeanyi Ali,” aka “Ifeanyichukwu Mezienwa,”
62 VICTOR UCHENNA AGUH, aka “Orch Sod,” aka “Uche SP,” aka “Rich Homie Urch,”
63 KEVIN AMARACHI ESHIMBU, aka “Humble,” aka “Humble Amarachukwu,” aka “Dato Humble,”
64 VITALIS KELECHI ANOZIE, aka “Kelechi Vitalis Anozie,” aka “Kelechi Anozieh,” aka “Pastor Kel Anozie,” aka “Pastor Kc,” aka “Choice,”
65 WILLIAMS OBIORA AGUNWA, aka “Don Williams,”
66 GEORGE CHIMEZIE DIKE, aka “Chimekros,” aka “Slim Dad…No…1,”
*67. MUNACHISO KYRIAN UKACHUKWU.  IGBOKWE's phones list +1.510.417.7578 as "Muna" and in his "imo" messaging app as "Muna Ukachukwu."  Twitter and imo give the email "munaukachukwu@gmail.com" and confirm the telephone number for Twitter accounts @Munachiso18 and @MunaUkachukwu.  The same information is used for a Skype account.  T-Mobile places him at 366 Ohio Ave, Richmond, California and a previous address, also on Ohio Avenue, matches his California DMV record.  He was a Lyft driver as well, using the same phone and email munac_2000@yahoo.com. 
*68. NWANNEBUIKE OSMUND.  +1.424.672.0859 is in IGBOKWE's phone as "Olivite" while EROHA lists him as "Nikky Bros." and IRO as "Nikky Bro."  T-Mobile places him in Carson, California, as does the DMV.  Yahoo ties that phone to nwannebuikeosmund@yahoo.com.  
69 CHIDIEBERE FRANKLIN NWANGWU, aka “Frank Chidi,” aka “Franklin Nwangwu,” aka “Agogo,”
70. DAMIAN UCHECHUKWU AJAH, aka “Uche Ajah,” aka “Ajah Damian Uchechukwu,” aka “Uchechukwu Demian Ajah,”
71. MEKA P. EJIOFOR, aka “Ejiofor Emeka,”
72. LAWRENCE CHUKWUMA UBASINEKE, aka “Ubasineke Chuks,” aka “Chukwuma Ubasineke,”
73. CHINEDU BRIGHT IBETO, aka “Doggy,” aka “Doggy Lucino,”
74. VALENTINE AMARACHI NWANEGWO, aka “Satis,” aka “Satis Amarachi Satis,”
75. EMMANUEL CHIDIEBERE DIKE, aka “Emmanet,”
76. JEREMIAH UTIEYIN EKI, aka “Uti,”

77. CHINAKA DAVIDSON IWUOHA, aka “Tmrw Afrika Will Wake Up,” aka “Cookie,” aka “All Africa Media Network,”
78. CHIMA DARLINGTON DURU, aka “Kajad,” aka “Kajad Jesus,”
79. IKENNA CHRISTIAN IHEJIUREME, aka “Piper,” aka “Am Happy!,”
80. OBI ONYEDIKA MADEKWE.  +234.703.472.4857 is in IRO and IGBOKWE's phones as  “Odu Invest" and "Obi LA."  +1.310.658.4080 is also in IRO's phone as "Obi Soccer."   Madekwe introduced himself by name in chat, and opened a Wells Fargo account (1223) in his own name.  He used the email omadekwe1@gmail.com and the 4080 telephone number.  Google links that email to the +234 phone.  IRO complains that his "Main Exchanger" has gone to Nigeria in April and May of 2017.  DHS confirms MADEKWE traveled to Nigeria in April 2017.


↧

Los Angeles: Stories of the BEC Victims (part 2)

August 27, 2019, 9:17 am
$
0
0
In my last blog post, Los Angeles Court charges 80 Nigerians with BEC and Romance Scam Crimes, we laid out the background of a major BEC investigation and telling the stories of six victims, but the court documents shared the details from thirty cases.


Footage from CBS Los Angeles of the arrests
In our previous post about this Los Angeles-based BEC Fraud Ring, we shared that the primary defendants, Valentine IRO and Chukwudi IGBOKWE had their phones seized in a search warrant.  The forensics evidence from their phones helped to identify their army of co-defendants who ran the scams using bank accounts established by IRO and IGBOKWE to launder the money.

Victim Company 3 - December 2016 BEC Fraud 

VC3 is a small landscaping services company in Oklahoma.  On 19DEC2016, they wired $18,457.13 from their Chase bank account to a US Bank account (2982). They received an email with wiring instructions for purchasing some equipment.  The next day, a fraudster sent NEW wiring instructions, claiming to be a correction to the previous day's communications.  The receiving US Bank account had a balance of -$408.51 when the transfer arrived.  Two ATM withdrawals were made the following day for $300 and $500, and a cash withdrawal of $8,500 was made from a teller at a bank branch the same day.  On December 27, 2016, US Bank sent the remaining funds back to the originating Chase bank account after the fraud was discovered.

In chats between MANSBANGURA and IGBOKWE the two reviewed which of their receiving accounts were "strong" and which were "under review."  The US Bank account was discussed, with IGBOKWE saying "Pls do not used XXX's us bank for any transaction. If u put money there It will get stuck. Never come out ... There is a restriction on d account."

The same US Bank account (2982) was also provided to several other romance scammers and BEC co-conspirators between November 21, 2016 and March 1, 2017.

Personal Victim B.Z. - Elder Fraud Victim

B.Z. is an 86-year old man with dementia and Alzheimer's who was repeatedly a victim of financial scams.  His son met with the FBI and explained the range of scams he had fallen for.  In 2013, his father joined a dating site and was scammed by a 37-year old Ghanaian woman who convinced him to invest $100,000 to purchase an apartment complex.  Later the woman was kidnapped and shot at the airport as she was bringing him a gold bar to repay him.  The man insisted on flying to Ghana to help her, but the family intervened.  In the current scam, Federal Reserve Chairman Ben Bernake and US Treasury Secretary Steven Mnuchin had let him know he was about to receive $107 Million.  He sent $11,900 to a Chase account (7605) that belonged to "T and F Enterprises."

March 14, 2017 - ONUWA told IGBOKWE that he wanted to use the Chase 7605 account for this scam.  He replied "OK"
March 16, 2017 - B.Z. transfers $11,900 from his Chemical Bank account in Michigan to the Chase 7605 account.
March 16, 2017 - ONUWA sends a photo of the application and agreement for wire transfer to IGBOKWE.
March 22, 2017 - ONUWA and IGBOKWE discuss how defendants IGBOKWE and MANSBANGURA would withdraw the funds from B.Z.'s wire transfer.
March 24, 2017 - IGBOKWE tells ONUWA the funds are "out" and ONUWA provides IGBOKWE his Nigerian bank account number.
March 27, 2017 - MANSBANGURA cashes a check for $4,000 from the Chase (7605) account. Memo: Rent
April 4, 2017 - IGBOKWE provides ONUWA his Nigerian bank account number with instructions to pay 3,123,000 naira (about $8500 current value).
April 6, 2017 - IGBOKWE provides ONUWA's name and Nigerian bank account number to IRO, with the request to pay 1,000,000 naira to the account (from IGBOKWE's telephone number: +1.213.425.8827).
April 6, 2017 - IRO provides ONUWA's name and Nigerian bank account to another unindicted co-conspirator with directions to pay the 1,000,000 naira.

Victim Company 4  - March 2017 BEC Fraud

Victim Company 4 was a dry food products company in Michigan that imports grains for resale.  Employees of VC4 believed they were communicating with another Michigan Company, when in fact they were communicating with fraudsters who had hacked Michigan Company's email accounts, implementing forwarding rules that caused their emails to be sent to the fraudsters.  FBI agents interviewed personnel at both companies and learned that on March 29, 2017, VC4 was tricked into wiring $29,679.17 to a Wells Fargo bank account (7245) believing it was the Michigan Company, when in fact it was a company opened in Whittier, California, under the name "Danisha Beauty Sales" on January 5, 2017.

The day the wire was made, the starting balance on Wells (7245) was $3.60.  After the funds arrived, they were used to make a $1,419.73 purchase at a Best Buy in Hawthorne, California, and a $300 cash withdrawal.  On March 31, 2017, the Wells (7245) account received an additional wire of $27,464.89, this time from a South American tour company (likely also a BEC victim).  Two checks were paid out from the account that day.

March 21, 2017 - VC4 receives fake email requesting $29,679.17 payment.
March 22, 2017 - $29,679.17 - VC4 wired to Wells (7245) from a BBVA account in Colombia  belonging to VC4.
March 22, 2017 - Best Buy shopping ($1,419)
March 27, 2017 - IGBOKWE sends to UMEJESI the Wells (7245) account info with text "Prefer make u use this one becaue the money wey dey enter too much)
March 29, 2017 - IGBOKWE sends UMEJESI a screenshit of the VC4 Wire Transfer confirmation.

March 29, 2017 - IGBOKWE sends the wire receipt to UMEJESI.  UMEJESI forwards it to IRO's Samsung phone.  IRO replies "Who gave you this slip.  Tell me his name."  UMEJESI replies "Kudon" (a nickname for IGBOKWE). "Because I gave him this ulo ako 4months ago and I'm surprised him sending me this."  IRO then reaches out to UMEJESI.  He responds "Mine is 29175 and 26." Apparently there was confusion over which scammers were to be using this account.

March 31, 2017 - $27,464.89 - SouthAmericanTourCo wired to Wells (7245)
March 31, 2017 - $11,160 check to UMEJESI 
March 31, 2017 - $16,520 check to OJIMBA (Ojimba Collins) 
(those checks deposited by the defendants into two separate Chase bank accounts -- (Chase 7290) and (Chase 1767) both in Inglewood, California.  UMEJESI sent IGBOKWE the userid and password information for the account holder's Wells (7245) account.  The account owner, a female, was walked into the bank by UMEJESI according to the text messages between UMEJESI and IGBOKWE. IGBOKWE later texts the Chase deposit slips to UMEJESI.)
April 1, 2017 - $4,000 cash withdrawn
April 1, 2017 - IGBOKWE sends messages to UMEJESI explaining the breakdown of funds -- "Our money is 11,840. There own money is 17,760.  $29,600 * 40% = 11,840" -- indicating that they were receiving a 40% commission for doing the money laundering on someone else's BEC scam.
April 20, 2017 - Wells Fargo seizes the remaining $23,531

Victim Company 5 - April and June 2017 

This Victim Company had someone attempt to steal their entire corporate coffers!  At IRO's direction, a fraudulent company was opened in the name of VC5 with papers filed in Los Angeles County to create the corporation.  Those papers were then used to set up a Chase bank account.

Feb 17, 2017 - IRO tells IGBOKWE to have MANSBANGURA take one of her mules to open a bank account in the name of VC5.
Feb 22, 2017 - MANSBANGURA causes her mule to open the account (Chase 5027).
March 20, 2017 - IGBOKWE sends IRO the account information, with account and routing number.
March 27, 2017 - IRO provides the account details to OGUNGBE in request for "an aza for 3m$ from Philippines today".  (An "aza" is Nigerian slang for a bank account - he needs an account that could credibly receive $3M, and IRO provides this one.) 
April 4, 2017 - Wells receives a counterfeit letter "from" VC5, notarized and with the forged signature of VC5's CEO, requesting that his Wells Fargo account be closed and all funds transfered to  (Chase 5027) -- a balance of $17,300,844.58! 
April 4, 2017 - a caller to Wells, pretending to be from VC5 asks them to confirm receipt and closure of the account
June 5, 2017 - Wells Fargo receives via US Mail a second letter, again requesting that the Wells account of VC5 be closed and that all funds be sent to (Chase 5027) -- a balance of $12,760,922.93!

Both of those account takeovers failed because they were detected by bank rules.

Personal Victim A.V. - April and May 2017 Elder Fraud Victim

A.V., an 87-year old woman whose property is now under guardianship by the county Department of Health and Human Services, lost $555,013.26 to fraud in less than a year, and at least $75,000 prior to that.  Related to the current charges, A.V. sent two wires of $8,035 to Wells (1147) and two wires of $6,060 to Chase (5027).  On interview, A.V. said she had sent the Chase wires from her Capital One account to assist her first cousin who had gotten married and moved to Thailand.

IGBOKWE and CHILAKA were involved in these scams.

April 10, 2017 - IGBOKWE and CHILAKA discuss funds they are anticipating will be deposited into Wells (1147).
April 11, 2017 - A.V. wires $8,035 from her Capital One account in Maryland to Wells (1147).
April 11, 2017 - CHILAKA sends IGBOKWE a copy of the wire transfer requests.
April 17, 2017 - IGBOKWE sends CHILAKA info for a Bank of America account (3037) after being asked "Give another without Nija name".  CHILAKA then asks "Can this be used f Ali?" --  ("Ali" is the term that the Nigerian scammers use when referring to BEC scams.) .  IGBOKWE replies "No." and then "If u need aza for Ali let me know."  ("aza for Ali" would mean "a bank account to be used in BEC wire transfers.)
April 27, 2017 - A.V. wires $2,700 from her Capital One account to Chase (5027).
May 8, 2017 - IGBOKWE and MANSBANGURA are discussing the A.V. fraud and mention "we cannot use that account for any transactions from Capital One anymore." MANSBANGURA says "Chase said they will force the money back to sender. Once it posted, Chase put a hard hold on it because they want to make sure it is NOT A FRAUD money."  MANSBANGURA told IGBOKWE "No more Capital one transactions to Chase."
June 2, 2017 - CHILAKA sends IGBOKWE a voicemail from A.V. "for Mr. Davis" explaining that she has instructed her Chase banker to release the $3,360 wire. 
June 2, 2017 - IGBOKWE sends CHILAKA an audio recording of MANSBANGURA calling Chase Bank asking about the status of the wire.

Personal Victims Je.F. and Jo.F. - April 2017 Escrow Fraud

The "F Family" lived in Illinois and were purchasing land in Texas.  As they were discussing how to fund the purchase, it is clear that fraudsters were intercepting their emails and injecting themselves into the conversations.  In particular, the F Family received emails that used the same email userid as the escrow company's email, but used the domain "mail.com" instead.  The same fraudsters were also sending email TO the escrow company, imitating the "F Family"'s real gmail account, using a slightly different gmail address.

April 9, 2017 - Je.F. receives instructions to wie funds to a Chase (6217) account opened by a money mule in Los Angeles.  EKECHUKWU managed this mule, who opened the account at the request of IRO.  A nearly identical account had been previously opened by CATHEY at the request of IRO in the state of Georgia earlier in April 2017.)
April 17, 2017 - Je.F. sends $135,800.72 from their BMO Harris Bank account in Illinois to the Chase (6217), believing they are paying for the Texas real estate and closing costs.
April 18, 2017 - EKECHUKWU asked IRO "anything coming in the warehouse?"  ("Warehouse" was one of the code words the crew used to refer to a bank account that should be receiving funds from one of their scams.) IRO gives the details for Chase (6217) saying "Check this. Something is inside" the following day.
April 19-20, 2017 - IRO discusses the F Family fraud with ANOZIE and AZUBUIKE.
April 19, 2017 - IRO complained to EKECHUKWU that Chase called the account holder wanting the money back.

We still have 18 more BEC Victim and Romance Scam Victim stories JUST FROM THIS CASE, so we'll continue this blog, probably in three more parts.  


↧
↧

Operation ReWired arrests 281 Business Email Compromise criminals

September 15, 2019, 4:59 pm
$
0
0
Operation: ReWired announced on September 10, 2019
On September 10, 2019, the Department of Justice announced that 281 arrests related to Business Email Compromise had been made, with 74 of those arrested being in the United States.  It will take some time to track down the names of all of those arrested, as many of the arrests were overseas.  Twenty-three US Attorneys Offices participated in the Operation, although only five sets of arrests were discussed in the Department of Justice Press Release about Operation ReWired.  While we work to obtain the rest of the information, we'll go ahead and share some details from those already made public in the Press Release.

Chicago Business Email Compromise: Stokes & Ninalowo defraud Energy Company and Community College of Millions

The first case involves two major BEC scams that followed the same mold.  The FBI says that an "un-named Community College" with about 15,000 students was doing business with a construction company our of Minneapolis, Minnesota.  An employee of the university received an email from someone claiming to be "Yvonne Nguyen, a Group Accounting Manager" for the construction company, that said "Hi, please see attached for our new ACH details." The "unnamed company" (easily identifiable by clues in the indictment) boasts of their large catalog of university and college related construction projects, including several in the Chicago area with projected build costs exceeding $20 Million.   The attached form was one that the college traditionally uses to ask vendors for payment details.

Because the request was on their own form, and seemed to come from a company who was involved in a large construction project for them, the college updated the payment details.  "On or about June 20, 2016" the college approved a "routine payment" of $3,371,291 directed to a Bank of America account.  Because of the updated payment information, on June 29, 2016, the payment was made ... but to the new account specified by the criminals.  Almost immediately after deposit, several transactions were attempted from the account, which triggered fraud rules at Bank of America, who froze the account while an investigations was conducted.  The largest such check was for $398,220, made out to "Steno Logistics."  Steno Logistics became a corporation in Illinois one day before the first Yvonne Nguyen email was sent.  The registered agent creating the corporation was Brittney STOKES, who used her home address on the account.  At the time, Stokes was also working as an assistant to the manager of a Menards home improvement store.

The second scam conducted by STOKES and NINALOWO invlved a $1.7 Million payment sent from a Houston, Texas oil company to an energy exploration company in Irving, Texas.  In exactly the same method as the first scam, an email claiming to be from the Exploration company was sent to the Oil company with the subject "ACH Update." The email said "We recently received a payment from your company and noticed that payments are still being made to our old bank. We have switched banks.  I will be forwarding you updated banking details once I have your confirmation.  I have also attached our W9 for your perusal."

This exchange led to a $1.7 Million transfer from Energy Company B to "Fake Exploration Company" ... in this case, the corporate email account WAS BEING CONTROLLED BY THE SCAMMERS.  They confirmed the update with a bank account at TD Bank after also confirming other details, such as their physical mailing address.  This led to a series of payments.  On January 9, 2018 - $97,729.65.  On January 11, $239,563.134 and $164,754.84.

In this case, Chase Bank shows that they also had a newly opened bank account for "Steno Logistics", also listing Brittney STOKES as the president, and opened with STOKES' Illinois Drivers License as proof of identity.  Each time a payment was received by "Fake Exploration Company", a check was issued from the fake company to Steno Logistics.  Checks included:

  • $22,054.17 on January 26, 2018
  • $35,000 on January 30, 2018
  • $833,672.50 on February 2, 2018
  • $608,488.90 on February 6, 2018
  • $186,483.73 on February 8, 2018

Large transfers were then made from the Steno Logistics account to accounts such as "Yummy Bear Day Care", which was a Citibank account.  Yummy Bear Day Care was also registered in the State of Illinois by Brittney Stokes.

On many occasions thereafter, bank surveillance video showed NINALOWO making cash withdrawals from the Steno Logistics account.  On Feb 3, 2018, Feb 5, 2018., Feb 6, 2018.  Captured text messages between STOKES and NINALOWO also make clear that some of the checks written against the account, including one for $50,000, involved NINALOWO forging the signature of STOKES.  The phones were seized for inspection by Customs and Border Protection as STOKES and NINALOWO came through US Customs, returning from Lagos, Nigeria, via the Atlanta Airport.

When they were arrested, Law Enforcement officials seized a 2019 Range Rover Velar S from Stokes and $175,909.

Dallas Texas: Opeyemi Abidemi Adeoso and Benjamin Adeleke Ifebajo

In the Dallas case, an individual sent a series of wires totalling $504,660.52 to a Dallas based bank account in February 2018.  A second business, in March 2018, also wired $179,223.33 to another Dallas-based bank account.  Upon investigation, these funds were being disbursed to someone using an alias identity "Daniel Sammy Campbell" and the street address "9451 Wickersham Road, Apt 2075, Dallas, Texas.  ADEOSO was the current resident of that apartment at the time of the fraud.  His previous landlord, at 6808 Skillman Street, recognized ADEOSO, and also informed law enforcement that he had been referred to rent there by his friend IFEBAJO.  IFEBAJO was proven to have utilized many aliases, including Joseph Eric Johnson, Jeremiah Alex Malcolm, Tidwell Anthony Wilsom, and Andrew James Wilson.  ADEOSO also used many aliases, including Peter Kuffor, George Macharty, Nelson Johnson, Braheem Larke, Michael Albert, Michael Jaden Sean, Michael Jeff Brown, and Benjamin Zee Brown.  Each had many fraudulent foreign passports and other alias identities used to open numerous bank accounts in the Dallas Fort Worth area of Texas.

ADEOSO was married to Bukola Comfort ADEOSO, who moved to Dallas Texas shortly after arriving in the United States.  On numerous occasions, when ADEOSO made a large cash withdrawal, a matching deposit would show up in BUKOLA's account.

ADEOSO opened a LARGE number of bank accounts.   Just using the Peter KUFFOR alias, which had a counterfeit Great Britain passport, he opened: 

  • BB&T - June 9, 2015
  • Capital One - June 24, 2015
  • Wells Fargo - June 24, 2015
  • BBVA - July 3, 2015
  • Bank of America - July 30, 2015
  • First Convenience Bank - November 9, 2015
  • Chase Bank - November 24, 2015

This alias often used the Yahoo email flavorj1@yahoo.com - which was also used by the George MACHARTY alias.  Macharty, using a counterfeit Nigerian passport, opened:

  • Wells Fargo - Sep 3, 2015
  • Bank of America - Sep 8, 2015
  • First Convenience - Oct 5, 2015
  • BBVA - Oct 7, 2015
  • Capital One - Oct 6, 2015
  • Chase Bank - Oct 28, 2015
  • BB&T - Nov 24, 2015
Alias Johnson Nelson accounts used the flavorj1 email and also justonceacademy@gmail.com 
  • Bank of America - Oct 20, 2015
  • Capital One - Oct 21, 2015
  • BB&T - Oct 22, 2015
  • Woodforest Bank - Jan 6, 2016
His other aliases also opened many bank accounts.  Between July 2015 and March 2016 these accounts received $423,285 in wire fraud proceeds from victim companies.
Another whole set of accounts was created in 2018 and 2019 and also received a large number of wire frauds from victim companies all across the United States, including the largest transfer, a $433,714.31 transfer to a BBVA account.
At the time of the Criminal Complaint, not all of the victims had been identified: 

Cherria Davis was married to Adeoso on April 17, 2015.  Ifebajo listed Cherria Davis as his US point of contact when he came to the United States on a non-Immigrant Visa on July 3, 2015, using the email "benvicschools@gmail.com."  Customs and Border Patrol seized a DHL package containing fraudulent passports in the names of Chris Hammington and James Alexander that were destined to IFEBAJO's residence at 11911 Audelia Road in Dallas, Texas.  

IFEBAJO also opened many accounts in many aliases, but tended to use business names.  As Jeremiah Alex Malcolm he owned "Breakthrough Auto Links" with a fake Great Britain passport.  Surveillance video in BB&T confirms Malcolm to be IFEBAJO.  As Andrew James Williams, he ran "Williams Retails and Equipment" who had a BBVA bank account and a Bank of America bank account.  As Joseph Eric Johnson he ran "Reality Global Equipments" with a fake Namibian passport and an IRS Tax EID 83-2508382.  He had BBVA, BB&T, and Wells Fargo business accounts with that identity, and surveillance video at Chase, BB&T, and Wells Fargo showing IFEBAJO doing banking as "Johnson".

Like ADEOSO, linked by the ties to Cherria Davis, IFEBAJO also had many deposits to his accounts known to be from BEC fraud victims, including: 



NYC: Ashu, Eke, Ikejimba, Ironuah

According to the Indictment, Cyril ASHU, Ifeanyi EKE, Joshua IKEJIMBA, and Chinedu IRONUAH "and others known and unknown" engaged in a fraudulent business email compromise ("BEC") schemes against "various victims, including an intergovernmental organization headquartered in New York, New York" convincing the victims to wire payments to bank accounts controlled by the defendants instead of the intended beneficiaries.  As in the previous cases, the victims all received emails that seemed to be from companies with which they were genuinely engaged in business, but which deceived them into changing the destination accounts for business transactions.
After receiving the funds, they were quickly transferred, withdrawn, and laundered, either by withdrawing cash or writing cashier's checks, many of which were cashed out at check cashing facilities in Houston, Texas.  Altogether, the defendants in this case caused to be transferred more than $10 Million in fraudulently gained funds.  Two examples of the activities charged are listed in detail related to two bank accounts, one opened by EKE and the other by ASHU:

The "0131 Account":


  • On October 28, 2016 - IFEANYI EKE opened a Marietta, Georgia bank account ending in 0131 using his alias "Luthur Mulbah Doley"
  • On Feb 15, 2017, a foreign-based healthcare company wired him $41,495 to that account, through a correspondent bank in the Southern District of New York.
  • On Feb 16, 2017, EKE sent two cashier's checks totaling $25,000 to CYRIL ASHU, who cashed one of the checks the following day.
  • On Feb 27, 2017, "an intergovernmental organization based in NYC wired $188,815 to the 0131 account.  
  • On March 1, 2017, EKE transferred $100,000 from the account to another account in his true name.
  • On March 2, 2017, EKE wrote a cashier's check for $68,000 payable to "Curesos Innovation" 
  • On March 2, 2017, a foreign-based manufacturing company wired $123,895 tot the 0131 account. 
  • Between March 2 and March 4, EKE bought three more cashier's checks:
    • $48,000 to Curesos Innovation
    • $68,000 to Yiwu Offshore Limited
    • $96,000 to Yiwu Offshore Limited 
  • On March 3, 2017, IRONUAH cashed the Curesos checks in Houston, Texas.
  • On March 6, 2017 IKEJIMBA cashed the Yiwu checks at the same check-cashing facility in Houston, Texas.
The "7622 Account":
  • From October 25, 2017 through December 2017, ASHU used a stolen identity to open a bank account ending in 7622 and received $12,366 in fraud proceeds.

Georgia: Emmanuel Igomu and Jude Balogun steal $3.5 Million via a BEC fraud against a health-care provider


On July 2, 2018, Tanner Health Systems of Carrollton, Georgia was hit by a BEC fraud.  Someone impersonating a THS vendor, Bernie Buchanan, the Executive VP of Ra-Lin and Associates, caused a payment of $3,528,500.02 to be misdirected to a Bank of America account in the name of GARRETT, LLC.  The account had only one valid signator: Ishmael GARRETT of Newark, Delaware.

Two outbound payments were made from the account.  $797,291.14 was sent to a SunTrust Bank account in the name "Audi Atlanta, LLC, 361 Pharr Road NE, Atlanta, Georgia.  On the same day, $570,780 was sent to a JP Morgan Chase Bank account in the name Lucia Tech, LLC at 5456 Peachtree Industrial Boulevard, Suite 632, Atlanta, Georgia.

The Lucia Tech account had been opened with a fraudulent South Carolina driver's license in the name of Lucy Andrews.  The address actually corresponded to a UPS Store box in the name of Henry Dax.  Henry Dax used the telephone number 678-590-6197 and the email palaso@mail.com.  Logs from the mail.com provider showed regular logins from an IP address 24.99.101.32, which belonged to a Comcast account at the street address 2340 Cheshire Bridge Rd NE, Apartment 404, Atlanta, GA 30324.  Georgia Power records show that the electric bill for that apartment was in the name Emmanuel Igomu, which the telephone number 678-900-5328.  

The Atlanta Police Department showed that they had been dispatched to that address based on a complaint from IGOMU showing that he had lost his passport!  IGOMU gave his telephone number to the Atlanta police as 678-900-5328.

A search warrant served at the address revealed that IGOMU was residing there with Stephanie Gaspard, who IGOMU claimed was his wife.   Fraudulent driver's licenses with their photos but other names were found, along with credit cards in names other than the resident's.  IGOMU's cell phone was broken and it and its battery were found submerged in the tank of the toilet.  When asked why, IGOMU said he must have stepped on it in his confusion from being awoken by the FBI's early morning knock.  He wasn't able to explain why it was in the toilet tank.

One of the fraudulent South Carolina driver's licenses was in the name Henry Dax and was used to open the UPS Store used as the address for LUCIA TECH, LLC.



The James Clark identity was used to open a Fidelity Bank account in the name "JCEE CLARK, LLC"

IGOMU is a Nigerian national who entered the US on June 23, 2014 on a six month Visa which has never been extended.  He had previously been arrested (though not deported) by the Atlanta Police Department charged with having 2 fictitious driver's license, a fictitious UK passport, and six different bank cards in three different names.  On January 9, 2017, he was convicted of five felony accounts, but only sentenced to three years probation under the "First Offender Act."

Miami, Florida: Govantes and Tamayo

Yumeydi GOVANTES was the sole officer of "Yumeydi Quality Products" a Florida corporation claiming to do business at 1441 Sandpiper Boulevard, Homestead, Florida.  They were incorporated on November 14, 2016. Yamel Guevara TAMAYO was the sole officer of YGT Buying Inc" a Florida corporation claiming to do business at 4840 NW 7th Street, Apartment 305, Miami, Florida.  They were incorporated on November 17, 2016.

From November 2016 through June 2019, the defendants participated in a conspiracy to commit wire fraud, laundering money by receiving funds into their bank accounts and then transferring the funds out of the country, primarily to China, after dipping into the funds for their own personal gain.  Some of those transfers are shown below:

More Information, Please ? ? ?

We've shared above the cases that were specifically named in the DOJ Press Release about Operation: Rewired.  Yet these were only FIVE of the 23 districts that had arrests.  If you have details on additional information, please reach out to me on Twitter ( @GarWarner ) or in the Comments section below!

As we shared back in July, all of this information is just the tip of the iceberg with regards to BEC fraud.  According to analysis by the Financial Crimes Enforcement Network (FinCEN), BEC losses during calendar 2018 exceeded $300 Million per month in theft! https://garwarner.blogspot.com/2019/07/fincen-bec-far-worse-than-previously.html

↧

FBI Fraud Arrests by Field Office, 2018

October 3, 2019, 2:46 pm
$
0
0

Each year, crime data geeks look forward to the publication of the CJIS "Crime in the United States" report.  On September 30th, the FBI was able to share the Uniform Crime Report information for 2018, describing information about Violent Crime, Property Crime, Homicides, and Arrests gathered from most of the law enforcement agencies in the United States.  UCR is old news though.  Many short-comings in the system have led to changes which are adopted in the new NIBRS system, the National Incident-Based Reporting System.  For people like me, who care about cybercrime, hacking, malware, and fraud, this is great news!  Many budget decisions have been made over the years about how to allocate police resources based on UCR data, and NONE OF THE CATEGORIES I CARE ABOUT WERE PART of UCR!   But NIBRS has many of those things, rolled up under the category "fraud."

Fraud Offenses are called "26" offenses and have the following breakdown:
  • 26A = False Pretense / Swindle / Confidence Game 
  • 26B = Credit Card / ATM Fraud 
  • 26C = Impersonation 
  • 26D = Welfare Fraud
  • 26E = Wire Fraud
  • 26F = Identity Theft
  • 26G = Hacking / Computer Invasion
(The NIBRS User Manual has the complete list of codes for other offenses.)

Last year, students in my Criminal Justice 502 - Computer Forensics class at UAB (the University of Alabama at Birmingham) - attempted to study fraud statistics from the 2017 NIBRS data, and sadly, their conclusion was that they were dramatically under-reported, and if used at all, used only in a "rolled-up" capacity.  NIBRS is currently receiving data from 6,600 of 18,000 potential law enforcement agencies.  By 2021, all agencies should be using NIBRS instead of UCR.

With shame, I mention that Alabama is one of the states boycotting NIBRS, calling it an "unfunded mandate" and refusing to participate.  In the 2017 data, only the city of Hoover shared NIBRS-formatted crime statistics with the Department of Justice.  (Hopefully we will see an improvement in this process as Alabama is now one of the states receiving federal funding to improve their NIBRS participation in the form of an NCS-X Initiative Grant.  In October 2018, an additional $49 Million was released to encourage greater participation.   A sampling study was conducted by BJS to determine that if 400 additional agencies were added, it would have a marked improvement of the accuracy and usefulness of NIBRS data, and these agencies and their states are now targeted, for the fourth year in a row, with Federal funding to assist in implementation.  Eleven Alabama Law Enforcement agencies were among the 400 on the "List of NCS-X Sample Agencies as of August 2018" making them eligible to apply for funding.  Only four states have not received any funding to date - AK, AZ, MS, and NM. Sixteen states have fully implemented NIBRS, and four more have >80% participation.)

We are still looking forward to seeing the 2018 NIBRS data, which would normally have been released by now, but did get one early present from CJIS, in the form of FBI NIBRS data from each field office.

https://ucr.fbi.gov/ucr-statistics-their-proper-use

A caution before reading on, despite the FBI's repeated warning to not use crime data to rank jurisdictions, journalists repeatedly put out reports called things like "The Top Worst Cities for Murder" each year after the UCR is released.  In the table below, we have extracted the FBI data for Fraud Arrests for each of their 56 field offices.  This is intended to show how fraud arrests (including all of the categories above) are still a MINOR focus of law enforcement by proportion of arrests, so PLEASE don't use this data to rank.  (More reasons not to rank in the link above, which is labeled "Caution Against Ranking" on the Crime in the United States page.

As part of that caution, consider a couple numbers from the table below.  While the average for all field offices was that 10.9% of all FBI arrest in 2018 were for "Fraud" categories, the Los Angeles Field Office number was more than double that amount, at 27.6%.  Why?  Is it because there is more fraud in LA than most places?  Not really.  Their "Fraud Arrests per 100,000 population" is 1.4, nearly double the national average of 0.8. Los Angeles serves the largest population of any field office -- 19.5 million people -- allowing their office composition to contain specialized squads not found in smaller offices. One such squad includes agents dedicated to working "Business Email Compromise" and they have been doing an amazing job at that task.  Because of the STRATEGIC FOCUS of the Los Angeles office, many criminals are arrested and charged there even when the victims may come from across the United States and the World.

Similarly, the Miami, District of Columbia, and New York offices have significantly higher fraud arrest rates per 100,000 populations than other offices. This also reflects the composition of their offices. New York City FBI arrested 1,466 total people in 2018 -- nearly 500 more than any other office, and triple the number of the arrests in only slightly smaller Dallas, Boston, Atlanta, or Charlotte. As a global super power in the banking world, New York City has one of the largest cybercrime offices in the country, including many New York Police Department personnel who serve as Task Force Officers within the FBI's Cybercrime and Financial Crime Task Forces. In offices like NYC, many cases where a local prosecution may have been brought elsewhere by the police have been elevated to a federal level, taking advantage of the unique concentration of banks AND FEDERAL RESOURCES, to make possible their 268 fraud arrests in a field office serving 13.4 million people. Similar combined state/local/federal task forces raise their arrest rate in other categories, partly as a result of the unique partnerships found in New York as a result of the restructuring of the FBI following the terrorist attacks there on 9/11.
Other office numbers may be skewed by the presence of an extremely gifted or well-funded state or local law enforcement agencies, which may work many cases at the state/local level that in other offices may have become federal cases.  
So again, please don't use these numbers for "head-to-head rankings," but do enjoy seeing what is going on in YOUR FBI office!  We look forward to seeing the full NIBRS data soon, but in the meantime, found the data below a fascinating representation of how fraud is fought by the Federal Bureau of Investigation.
(Full FBI Arrestees by NIBRS Offense Code by FBI Field Office, 2018 available here)
(Crime rate per 100,000 is ((Arrests / Population) x 100,000), for example, in NYC, (268/13,464,042 = 0.000019904 * 100,000 = 1.99 (rounded to 2.0) per 100,000 population.)
Field OfficeFraud ArrestsTotal ArrestsPopulation% Fraud ArrestsFraud arrests per 100k population
Grand Total All Offices2,64524,174330,611,01610.9%0.8
Albany191933,959,1429.84%0.5
Albuquerque113682,095,4282.99%0.5
Anchorage3110737,4382.73%0.4
Atlanta 8663510,519,47513.54%0.8
Baltimore203977,009,8895.04%0.3
Birmingham 161532,885,67910.46%0.6
Boston 7851510,654,32615.15%0.7
Buffalo283182,745,3248.81%1.0
Charlotte 2254810,383,6204.01%0.2
Chicago723999,299,34218.05%0.8
Cincinnati 232575,973,0038.95%0.4
Cleveland 404265,716,4399.39%0.7
Columbia253135,084,1277.99%0.5
Dallas 4255610,937,8927.55%0.4
Denver 554006,273,30113.75%0.9
Detroit 1327629,995,91517.32%1.3
El Paso 132171,280,4005.99%1.0
Honolulu19921,420,49120.661.3
Houston 453488,739,89012.93%0.5
Indianapolis 635416,691,87811.65%0.9
Jackson 192302,986,5308.26%0.6
Jacksonville 421295,292,49132.56%0.8
Kansas City215726,107,8123.67%0.3
Knoxville 164132,634,7463.87%0.6
Las Vegas 132943,034,3924.42%0.4
Little Rock 112093,013,8255.26%0.4
Los Angeles 27097819,503,77827.61%1.4
Louisville 171774,468,4020.96%0.4
Memphis 352924,135,26411.99%0.8
Miami 24110487,101,5800.23%3.4
Milwaukee281805,813,56815.56%0.5
Minneapolis 356207,253,4915.65%0.5
Mobile141962,002,1927.14%0.7
New Haven243153,572,6657.62%0.7
New Orleans 132344,659,9785.56%0.3
New York 268146613,464,04218.28%2.0
Newark555338,055,34210.32%0.7
Norfolk 151081,759,48413.89%0.9
Oklahoma City 202523,943,0797.94%0.5
Omaha102945,085,4130.34%0.2
Philadelphia1067239,948,74514.66%1.1
Phoenix 347737,171,6460.44%0.5
Pittsburgh 405435,517,3257.37%0.7
Portland323034,190,71310.56%0.8
Richmond 101104,153,7059.09%0.2
Sacramento 332988,099,06811.07%0.4
Salt Lake City 536065,977,6188.75%0.9
St. Louis 264222,930,1456.16%0.9
San Antonio 368797,743,6630.41%0.5
San Diego 333843,529,0648.59%0.9
San Francisco713428,425,13520.76%0.8
San Juan1407163,443,5825.59%1.2
Seattle 343597,535,5919.47%0.5
Springfield121573,441,7387.64%0.3
Tampa 308008,905,2543.75%0.3
Washington, Dc766713,306,95111.33%2.3
↧
Search

18 Members of ATM Skimmer Gang Arrested -- Mostly Romanian

October 15, 2019, 4:29 am
$
0
0
DOJ Press Release: 18 Members of International Fraud and Money Laundering Conspiracy
The Southern District of New York brought charges on 18 people for their involvement in an ATM Skimming ring that planted hundreds of skimming devices in at least 17 states and stole more than $20 Million dollars.  Those charged, from the DOJ Press Release about the ATM Skimming organization, are listed below.  The operation involved many cooperating agencies, including the FBI, Customs and Border Protection, the NYPD, the US Postal Inspection Service, INTERPOL-Rome, INTERPOL-Mexico City, and Mexico's Agencia de Investigación Criminal and Instituto Nacional de Migración.

What the press release does NOT make clear is the ties to Intercash, the largest Romanian ATM Skimming ring in history, and the primary reason that when you see "Skimming arrests" in the United States, they will almost always involve Romanians.

LIMBERATOS, COSTEA, LYMBERATOS, ELIOPOULOS, SAMOLIS, LAM, and MIHAILESCU were arrested in and around Manhattan on October 10, 2019.

M. CONSTANTINESCU, CALUGARU, I. CONSTANTINESCU, and SERBAN were arrested in Miami on October 10, 2019.

MARTIN (Pictured here as "Florian M") was arrested in Cabo San Lucas, Mexico.  Although he was the only one charged in the SDNY case, he was actually arrested as the leader of a group of 7 Romanians all arrested together in Mexico.  In Romanian news, he is described as "the brother of Rechinu".  Rechinu, which means "shark" in Romanian, is believed by the Romanians to be the big boss of an international skimmer ring, named Florian Tudor.  Brian Krebs, the world's leading investigative  security journalist, shared many more details about Rechinu's gang in April 2019, in a follow-up to his three part series about Instacash - a Romanian crime syndicate that dominates the skimming world. That KrebsOnSecurity story, "Alleged Chief of Romanian ATM Skimming Gang Arrested in Mexico" includes many details learned by interviewing the brother of a bodyguard that was assassinated by Tudor.

Romanian press says that Rechinu was also a human smuggler, helping "hundreds of Romanians" migrate to Mexico using counterfeit documents and then cross the border into the United States to participate in criminal activity.  Not only did Rechinu run an enormous international crime ring, but through shell companies, he was the owner of a company in Mexico that installed and maintained ATM machines for banks in Mexico!  Using the knowledge and access his employees gained by having "legitimate" access to such equipment, it is no wonder that InterCash dominated the skimming market!

Tudor Florian has managed his network, most of the time, in Mexico, under the screen of some companies that set up ATMs and ensure their maintenance! On the legally installed ATMs, skimming devices were mounted, which copied the cards of the people who were making money. 

"After fraudulently obtaining the computer data, teams were made up of other members of the group who traveled to other states such as USA, India, Paraguay, Indonesia, etc., from which they withdrew the existing amounts of money in the bank accounts related to electronic payment instruments. copied ”, claims DIICOT.  -- Translated from the Libertatea.ro story "DIICOT Release: The Shark Clan in Craiova had companies that legally set up ATMs in Mexico, where they later cloned the cards!"

(Libertatea - "Freedom!" - ran a month-long series of investigative reports about this crime family that they dub "the Shark Clan", including their long involvement with another Romanian crime family that sold them underage girls for sex trafficking)



VIDRASAN was arrested in Perugia, Italy.

PETRESCU, DIACONU, ANCA, and ULMANU were already in custody on other charges and will be later transferred to New York.

The charges were brought in three separate indictments.  Mircea CONSTANTINESCU, Nikolaos LIMBERATOS, Cristian COSTEA, Alin Hanes CALUGARU, Ionela CONSTANTINESCU, Theofrastos LYMBERATOS, Andrew ELIOPOULOS, Valentin PETRESCU, Peter SAMOLIS, Kelly Karki LAM, George SERBAN, Dragos DIACONU, Madlin Alexandru ANCA, Cristian ULMANU, and Iuliana MIHAILESCU were charged in the first indictment with:

  • 18 USC Sections 1029(a)(1), (a)(2), (a)(3), (a)(4), and (a)(5) - access device fraud 
  • 18 USC Section 1029(a)(1) producing and trafficking in counterfeit access devices
  • 18 USC Section 1029(a)(2) using a counterfeit access device to obtain a thing of value
  • 18 USC Section 1029(a)(3) aggravated identity theft (possessing with intent to obtain a thing of value more than 15 counterfeit access devices
  • 18 USC Section 1029(a)(4) producing, trafficking in, having custody and control of and possessing counterfeit access device-making equipment
  • 18 USC Section 1029(a)(5) conducting transactions with access devices issued to another person to receive payment exceeding $1,000 in a single year.  (Yep, $20M > $1,000)
  • 18 USC Section 1343  Bank Fraud , Wire Fraud, 
  • 18 USC Section 1349  obtaining money from FDIC insured institutions by means of false and fraudulent pretenses 
  • 18 USC Sections 1028(a)(1), (b), and 2.
  • 18 USC 1956(a)(1)(A)(i) conspiracy to commit wire fraud and bank fraud 
  • 18 USC  1956(a)(1)(B)(i)  conspiracy to commit access device fraud 
  • 18 USC  1957(a) conspiracy to commit wire fraud 
CONSTANTINESCU shipped a credit card point of sale terminal from Mt. Pocono, Pennsylvania to Veracruz, Mexico for the purpose of having a custom skimmer created for the terminal. SERBAN shipped skimmers from Miami to Tobyhanna, Pennsylvania.

Others installed skimmers in at least Babylon, NY (N. LIMBERATOS); Canterbury, CT (CALUGARU); Manchester, NH (T. LYMBERATOS); Glen Cover, Westbury, and Whitestone (ELIOPOULOS), NY; Boston, MA (PETRESCU); Queens, NY (SAMOLIS); Somerville, MA (ULMANU); Boston, Brookline, Sturbridge, Brighton, and Natick, MA (MIHAILESCU).

Others used cards to withdraw funds using counterfeit ATM cards coded with the magnetic stripes stolen by the gang's skimmers in at least New York City, NY (CONSTANTINESCU), Chattanooga and Ooltewah, TN (DIACONU,  ANCA); 

Others arranged the cash deposits and withdrawals to launder the funds (LAM)

A second indictment separately charges Raul Ionut VIDRASAN with many of the same charges.

A third indictment separately charges Florian Claudia MARTIN (and his host of aliases) and Alex DONATI. Specifically MARTIN is charged with installing a skimming device on an ATM in a hotel in Manhattan.  DONATI is charged with shipping a package containing two skimmers to Manhattan. 


Defendant
Age
Place of Residence
Nationality
FLORIAN CLAUDIU MARTIN,
a/k/a “Florin Claudiu,”
a/k/a “Johnny Ion,”
a/k/a “Jane Hotul,”
a/k/a “Petru Andrioaie,”
a/k/a “Petru Andrioane,”
44
Cabo San Lucas, Mexico
Romania
ALEX DONATI
51
Cabo San Lucas, Mexico
Romania
RAUL IONUT VIDRASAN,
a/k/a “Michu,” a/k/a “The Boy”
27
Perugia, Italy
Romania
MIRCEA CONSTANTINESCU, a/k/a “Sobo”
44
Cooper City, Florida
Romania
NIKOLAOS LIMBERATOS, a/k/a “Nicu Limberto”
53
Deer Park, New York
Greece
CRISTIAN COSTEA, a/k/a “Momo”
44
Queens, New York
Romania
ALIN HANES CALUGARU
39
Sunny Isles, Florida
Romania
IONELA CONSTANTINESCU, a/k/a “Pitica”
35
Cooper City, Florida
Romania
THEOFRASTOS LYMBERATOS
36
Queens, New York
United States
ANDREW ELIOPOULOS
34
Queens, New York
United States
VALENTIN PETRESCU, a/k/a “Gico Cosmin Giscan,” a/k/a “Zoltan Pruma”
32
Russellville, Arkansas
Romania
PETER SAMOLIS
30
Queens, New York
United States
KELLY KARKI LAM
42
New York, New York
United States
GEORGE SERBAN
32
Miami, Florida
Romania
DRAGOS DIACONU
41
Nashville, Tennessee
Romania
MADLIN ALEXANDRU ANCA, a/k/a “Mateo Fernandez Alejandro”
22
Nashville, Tennessee
Romania
CRISTIAN ULMANU, a/k/a “Boris Moravec”
54
Russellville, Arkansas
Romania
IULIANA MIHAILESCU
42
Queens, New York
Romania


↧

"Welcome to Video" raid leads to 337 arrests due to Bitcoin Exchanges that use strong KYC

October 16, 2019, 10:27 pm
$
0
0
The darkweb child sexual exploitation video site, "Welcome to Video", first came onto Law Enforcement's attention as a result of a case in the UK, where a geophysicist Matthew Falder was arrested.  When the National Crime Agency was looking into his hard drive, they found he had been a member of "Welcome to Video" which at the time used the dark web address mt3plrzdiyqf6jim .onion.  Anyone visiting that website recently would have seen this banner instead:


Law enforcement actually got the website through a silly webmaster error.  One of the webpages on the website linked some of its component files by the server's IP address instead of its onion URL address.  The IP address, 121.185.153.45, was a Korea Telecom address.  They got the owner's address details and were able to confirm his identity.

After establishing undercover addresses, searches on the website for some common child sexual exploitation searches, and received indications that there were THOUSANDS of matching videos.  I don't know that we should share the terms with our readers, but some search terms resulted in more than 7,000 or even 10,000 matching videos.  Searches for videos involving children as young as four years old or even two years old yielded 4,000 matching videos each.

 Anyone could view "thumbnails" on the site, but to download or view the related videos, you had to have Points.  You could buy points for bitcoin, or you could "earn" points by uploading a unique video, or having a friend sign up and use your referral code.

 On multiple occasions, including September 28, 2017 and February 23, 2018, federal agents made payments on the website, and within 48 hours, the money had been moved to another Bitcoin wallet.  That wallet turned out to be a Coinbase wallet.  When they asked Coinbase who paid for that Bitcoin account, it was Jong Woo Son. To be able to buy Coinbase from a bank account, Jong was required to provide KYC (Know Your Customer) information, so he provided and confirmed an email address and telephone number, both of which were found to belong to Jong.

That gave law enforcement enough to raid Jong's residence, where they found the server in his bedroom, containing 8 TB of child sexual exploitation images, and log files indicating that MORE THAN A MILLION videos had been downloaded from the site.  The raid was conducted by US IRS-CI, US HSI, UK NCA, and the South Korean National Police.  By comparing the hashes of these videos to the collection at NCMEC (The National Center for Missing and Exploited Children), they found that 45% of these videos had never been seen before.

MANY of the users of the site were "creating" videos by abusing children they had access to. The United States has indicted Jong Woo Son, but he is already serving time for charges brought in South Korea.  The indictment does provide a great deal of information about the case that helps us understand what happened:


(from the Jong Woo Son indictment)
We know from other sources that the "exchanger in the United States" is Coinbase (see below).  Every time Welcome To Video presented an opportunity for payment to a visitor, it generated a new potential Bitcoin wallet address.  Until someone makes a payment, however, it is more like a "potential" wallet.  If the visitor wasn't sure how to get Bitcoin, Jong's website recommended that an easy way was to set up a Coinbase account!
By tracing other addresses that also moved small payments to the same wallet that the undercover payments were moved to, they were able to identify a "cluster" of 221 frequently used bitcoin addresses that had been used to receive payments that were then sent to the website owner, Jong Woo Son.  Later, they asked Coinbase, and two other major Bitcoin Exchanges, to identify accounts that had sent payments to any of that pool of 221 bitcoin addresses.  Why so many?  To make sure which payment belongs to which user, when a user indicates they are about to make a payment, they are assigned a bitcoin address to use for their transaction.  This is fairly common practice on darkweb markets. To avoid conflicts, Jong had many such addresses that would receive the payment from a specific user, probably created at transaction time. Jong would consolidate these bitcoin "wallets" by moving the funds to his primary account, from which he sometimes withdrew funds directly to his bank account. Because transacting against a bitcoin address creates new addresses, those at least 7,300 small payments were paid to different addresses controlled by Jong over time.
This was really spelled out in detail as the prosecutor, and then the FBI agent, tried to explain bitcoin to the judge in the Gratowski case.   That was the Texas case involving former HSI Agent Richard Nikolai Gratowski.  Same thing.  He used his own USAA Credit card to pay Coinbase to buy his bitcoin.  I have the 100 page transcript of his court hearing, which was fascinating to read.  He was sentenced to 70 months (and has already appealed to the 5th circuit.)  Most of the court documents referred to "Bitcoin Exchange 1" -- but the transcript names Coinbase 84 times!  I think they deserve a lot of the credit for making this case possible through their strict KYC implementation!


Subpoenas asking for "who has been sending money to these 221 bitcoin wallets?" is where they got their hitlist of 337 site users who were arrested.  They including pedophiles residing in Alabama, Arkansas, California, Connecticut, Florida, Georgia, Kansas, Louisiana, Maryland, Massachusetts, Nebraska, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Texas, Utah, Virginia, Washington State and Washington, D.C. as well as the United Kingdom, South Korea, Germany, Saudi Arabia, the United Arab Emirates, the Czech Republic, Canada, Ireland, Spain, Brazil and Australia.  MOST of those users were identified because of the strict "Know Your Customer" rules that reputable bitcoin exchanges are now requiring of their customers. 

As a result of all of the investigations so far, at least 23 underage children were rescued in the US, UK, and Spain!

In ALL of the US cases I pulled court records for, that was the process.  Find a username on the seized server, prove that they had transacted bitcoin from a KYC-friendly exchange, such as Coinbase, then subpoena the bitcoin exchange to see who owned the account.  Coinbase and other reputable Bitcoin Exchanges, requires "strong Know Your Customer" as a means of reducing fraudulent or criminal behavior.  For Coinbase, that includes a drivers license scan, and a response to both an email and an SMS message to confirm that they know your real email and real telephone number.  For the accounts found, they could then check the Korean server to see which user had made a payment at that time and date, and how much activity they had on the server.  Then law enforcement would either confront the pedophile or conduct a search warrant to get confirmation of the evidence from the customer.  Priority was placed on anyone who seemed to be CREATING the content, or who had previous related charges.

Michael Ezeagbor was found to have used the identity "mikeexp1" on the site.  He had earned points by uploading 10 videos, and had downloaded 42 videos.  He paid 0.1 BTC on Jan 29, 2016 (which at the time was only $38.)  The Bitcoin exchange he used provided his DOB, SSN, address, and a Yahoo email account.  He had bought the bitcoin on the exchange using his A+ FCU account.

Eric Wagner paid 0.06 BTC on November 5, 2016 (about $43 at the time).  He had downloaded 40 videos and uploaded 84 videos.  His bitcoin exchange revealed his email was "wagnered@comcast.net" and he was using a DFCU debit card which matched the name, address, and SSN on file with the bitcoin exchange.

Brian James LaPrath was identified in the same way.  Because he had NOT uploaded, choosing just to pay, and had downloaded very little, he was allowed to plea to money laundering, although he is doing probation with sex offender style limitations in place.


The most troubling case I reviewed was that of Nicholas Stengel who had PREVIOUSLY been arrested for possession of child pornography and had served 41 months, followed by 36 months supervised release.  His supervised release included all of the above, and more.  He relapsed during that time, refusing to take his court ordered polygraph, and was charged with using a computer in violation of his parole to seek child pornography and with public masturbation.  In his first case he was charged with possessing 79,335 images and 230 videos.  When HSI Agent Scott Stein hit his door with a warrant, Stengel's wife stalled the agents at the door while Stengel got into his bathtub with a knife and slit his own wrists and throat!  He was given emergency medical case, but now found to possess 805,457 images and 6,884 videos!
Stengel attempts suicide during his search warrant

Several others who were charged with PRODUCING child sexual exploitation imagery to upload to the site were listed in The Daily Mail's story on the case:

Paul Casey Whipple, 35, of Hondo, Texas, a U.S. Border Patrol Agent, was arrested in the Western District of Texas, on charges of sexual exploitation of children/minors, production, distribution, and possession of child pornography. Whipple remains in custody awaiting trial in San Antonio

Michael Lawson, 36, of Midland, Georgia, was arrested in the Middle District of Georgia on charges of attempted sexual exploitation of children and possession of child pornography. He was sentenced to serve 121 months in prison followed by 10 years of supervised release following his plea to a superseding information charging him with one count of receipt of child pornography

Nader Hamdi Ahmed, 29 of Jersey City, New Jersey, was arrested in the District of New Jersey, for sexual exploitation or other abuse of children. Ahmed pleaded guilty to an information charging him with one count of distribution of child pornography. He is scheduled to be sentenced Oct. 1, 2019

Jeffrey Lee Harris, 32, of Pickens, South Carolina, pleaded guilty in the District of South Carolina for producing, distributing, and possessing child pornography

Nikolas Bennion Bradshaw, 24, of Bountiful, Utah, was arrested in the State of Utah, and charged with five counts of sexual exploitation of a minor, and was sentenced to time served with 91 days in jail followed by probation;



↧
↧

Stories of Romance Scam Victims: Ronayerin Ogolor

October 29, 2019, 10:21 am
$
0
0
Ronayerin Ogolor has pled guilty to causing $900,000 in losses to at least 13 Romance Scam victims.  Ogolor, a 50 year old naturalized citizen from Nigeria, lived in Kansas City, Missouri when he committed the various fraud schemes.  After "falling in love" via ChristianMingle, Facebook, or Hangout.com, Ogolor would begin to string his victims on to being lured out of their finances, whether or not they were wealthy.

Ogolor maintained multiple bank accounts.  Two US Bank accounts in his own name (ending in 8969 and 1885), a Wells Fargo account ending in 6281 in the name "Ronayerin Ogolor Merchandise", and a Wells Fargo account ending in 2141 in the name Ovrichona - a business involved in "overseas auto sales." A Bank of America account ending in 6776 in the name "American Quarter Horse Association eBanking", as well as BofA accounts ending in 4957 and 1988 in the name "Ogolor Merchandise." A Bank Midwest acount in the name "Rons Solutions" which he claimed was a Beauty Salon originally, but told a Bank Midwest employee bought American goods from cars to diapers and resold them in Nigeria.

He paid for his online dating sites via "AlcudaBill"

We thought it would be illustrative to share some of his schemes found in the Criminal Complaint.

Victim 1 - Alabama
Met "Charles Zolt" on ChristianMingle.com.  He was an "oil rig worker".  Zolt convinced Victim 1 to sell her car and wire him $9,500.

Victim 2 - Ohio
Met "Bradley Majestic" on ChristianMingle.com.  He was also an "oil rig worker" who claimed to be from Belgium. Victim 2 sent him over $30,000 in paymets starting with $3,500 in March 2015.

Victim 3 - Indiana
Met "Lawrence Garrison" after receiving a Facebook friend request.  Garrison also was an oil rig worker.  He claimed to have been born in Denmark. He sent a photo of a $4 million check, claiming he would pay her back when he got home by cashing that check.  He needed help getting funding to tow a $500,000 drill head to Ohio.  Victim 3 "invested" $450,000 overall in the scam.

Victim 4 - Washington
Met Ogolor in a variety of aliases.  Repeatedly tricked into wiring money to help meet fees associated with money transfers of up to $1 million USD.

Victim 5 - Minnesota
Met "David Stasiak" on Facebook.  Stasiak claimed to be a general contractor for Baytex Energy who worked on an oil rig.  She sent money to pay taxes on a large amount of gold that Stasiak was bringing into the country.  She "paid taxes" moving the gold through Qatar and Turkey, eventually being told that a final $32,000 had to be paid to a customs officer at Hartfield Airport in Atlanta to get the gold delivered.  She did not send the final payment, but was out several thousand dollars by this time.

Victim 6 - Arizona
Met "Samantha Brown" from Australia.  Claimed she had received a $250,000 inheritance.  She deposited the money into Victim 6's account and sent $60,000 to Haxzades Auto, LLC; $80,000 to Ronnie Leon Hammers; and $70,000 to Wells Fargo account 2141 (Ronayerin Ogolor dba Ovrichona Company.)  The $250,000 was the proceeds of a BEC scam.

Victim 7 - Texas
Met "James Philip" a US Army General in Afghanistan and agreed to help him smuggle two cases with $5 million in cash back to the USA.  Victim 7 sent three wires totaling $68,000 to pay various fees to help get these cases through customs.

Victim 8 - Florida
Met "Gary Ross Rodney" on Facebook.  Communicated via Skype and Email.  Claimed he had a UK bank account worth $500,000 to pay taxes to get the funds to the United States.  Victim 8 SOLD HER HOUSE to get Rodney the needed money, wiring $56,000 and $65,000 to Ogolor Merchandise's Bank of America account (4957).

Victim 9 - Illinois
Met "Manuel Rigby" on Facebook.  Rigby worked on an oil rig.  Claimed he had been detained in Atlanta, Georgia for traveling with too much cash.    Sent a total of $60,000 to get her boyfriend out of prison.

Victim 10 - Texas
met "Jonathan Lester" on either ChristianMingle or EHarmony.  Lester worked on an oil rig!  (Are  you surprised?)  Lester claimed to be from France.  He was importing a box with $2.75 million in cash, but needed to pay some fees to get it through Customs.  Via Hangouts, Victim 10 was instructed to send a $24,500 cashier's check to Ogolor Merchandise's BofA account 4957.  Altogether, she sent "Lester" $126,400.

Victim 11 - Florida
Met "Linda Stout" on Hangout.com.  Ogolor Sent him a $6,500 check and asked him to keep $1500 and send the other $5,000 to the Ogolor Merchandise BofA account.  (The check was fraudulent.)

Victim 12 - Italy
Met "Alexander McFelix" on Facebook.  McFelix was a U.S. Soldier serving in Afghanistan.  Wired money to help McFelix pay fees to retire early.  Over $13,600 in three payments to three different bank accounts controlled by Ogolor.

Victim 13 - California
Met "Robert Williams" on Facebook.  Williams worked for an oil company in Saudi Arabia, 'so his salary was paid in cash.'  Now needed help paying fees to bring his box of $2.6 million in cash through U.S. Customs.  Victim 13 sent more than $345,000 to pay various fees to import the money -- all to accounts controlled by Ogolor and associates, including a Citibank account in the name of Owurachanel LLC, an account in the name BJs Global Sales, and an account in the name Vinpep Services, LLC, and an account in the name TLA Technology & Consulting LLC.

For the dramatic conclusion ...

On October 19, 2018, the FBI learned that Ogolor had purchased a plane ticket to Frankfurt, Germany. He was arrested in the Kansas City International airport as he waited to board his plane.

Ogolor pled guilty on October 23, 2019, and signed a statement agreeing that he understood he may get 20 years in prison, a $250,000 fine, three years supervised release, an order to pay restitution to his victims, and possible deportation from the country after release.






↧

A Targeted (?) Phish from a LinkedIn Connection

November 1, 2019, 5:56 am
$
0
0
This morning while I was on the Exercise Bike at the UAB Rec Center I got a LinkedIn message from a colleague I haven't spoken to in a couple years.


That was actually the SECOND funny thing about my LinkedIn profile this morning.  The first one was that, since I'm a Premium Member, I get notified when people check out my Profile there.  I had one unusual visitor:

彭家’s Profile
Peng Jia has a TOTALLY BLANK LinkedIn profile.   linkedin.com/in/家-彭-334485167

I sent John a text message on his phone, but followed up, knowing I was likely talking to a scammer, with a LinkedIn Reply:

Well, since it was "really" from John, I finished my 10 miles on the bike, showered, ran back to my office and fired up a VM to visit his link:



Gee, what was I worried about?  It's totally from John!  It says right there!

Of course, some might find it odd that the "View Message Folder" link takes me to the URL 
" eone [.] ga /mm/business/proposal/afzz "

Now this is where "Targeting" comes in ... Take a look at this Phishing website and try to think what industry might be targeted by this LinkedIn-propagated phishing campaign?  



Hmmmm... AstraZeneca,  Proctor & Gamble, Boston Scientific (who makes Medical Devices)  ... thought I had a pattern, but then General Electric and Nationwide Insurance?  and Pandora?  Is that the Music Streaming logo? (I don't know, I use Spotify)

But here's the thing ... I'M EMPLOYED BY UAB -- The University of Alabama at Birmingham -- one of the largest and best funded research hospitals in America!  Any chance that I'm getting LinkedIn spam because - to a casual observer - I'm a HOSPITAL employee?  And then having this tagged up with at least three health care logos?  Ok, so what happens next?

Well, then they steal your email and password ... 


Gmail was the only one that had a second page ... if you entered Gmail it then wanted your phone number too.


We grabbed the phishing kit, because that's what we do, and took a browse around.


All of the individual files have the same "Action" -- which is to call Finish . php


Finish is where the entered information gets mixed with environmental variables from your machine and all of the details get emailed to the criminal.

The last piece is that the email address is referred to by a variable name that isn't in this PHP file:

If you scroll back to the top of "Finish . PHP" you'll find what you need there:


The top line shows which additional files should be loaded by the phish.  "CONTROLS" is the one we want, which is where we find the criminal's email address:  madiba23101@gmail.com 


It would make a great example for my students if anyone in Law Enforcement cared about this ... but sadly, the only people who care are the LinkedIn Security Team, who had this account down so fast that by the time I responded with "So shall I call you Madiba?" my friend John's account had already been secured and gave me an error message.

A couple last funny notes ... the kit contains a file called "Netcraft_check.php" that checks to see if the user agent is "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)") and refuses to load the page if it is.  Might want to update that user agent, Netcraft hunters.

There is also a file "visitor_log.php" that gives away the fact that all of the visitors to this phish have their IP address, timestamp, and browser agent shared.   because of this, we can tell that a bunch of people visited the phish from LinkedIn, becasue it adds "Mobile/15E148 [LinkedInApp]" to the end of the browser agent string.  As of this writing, only 127 unique visitors have been to the phish.  41 of them were browsing the phish from within the LinkedIn application on a Mobile Device.



Unfortunately for the Phisher, the poor fool put his phishing site behind CloudFlare, so the referring IP addresses are NOT the victim's IP address, they are all CloudFlare IPs.  Oh well.  Nice Try, Mister Phisher.  (we'll shoot this to CloudFlare to terminate your hosting as well.)

↧

A Phish That Scans For Viruses

November 5, 2019, 4:23 am
$
0
0
While I was on the train today I was checking email and found that I had received an interesting phish.  It was sent to an email i haven't used in years that apparently still fowards:

I certainly didn't want to miss my "incomming" fax, so I of course needed to click the link to "Preview Fax Message." 

The phish started off going to "outlake-q.hopto[.]com" and passing my email address as a parameter in the URL.  I changed that up a bit as you'll see below.  The HopTo address claims it is "Connecting to OneDrive" but it's really forwarding to the rest of the phish.

"Leak-weave[.]gq" says "Please wait ..." while it continues connecting to OneDrive I guess. . . ?
Once it connects to OneDrive (which apparently is now hosted at leak-weave) it asks me to "Please hold a while" as "OneDrive Security is scanning your file for virus!" 


Great news!  No Virus detected on file!

"Scan Complete!  Your file is secure and safe for download. Office365 OneDrive."  So I guess I can Download the file, right?

Not so fast!  First we have to confirm the password for "ohno@pleasedonhackme.org" 

It takes the time to actually connect to the PleaseDonHackMe.org mail server and concludes that I have entered an "Invalid password"


No file for you!

Now, if a visitor actually believed there was a file, they may have been tempted to provide their REAL password at this time.  I don't know if that would result in a Download or not, but I've decided not to find out!

Hope you enjoyed today's Adventure in Phishing!  Tune in next time to see .  .  . well, we don't know what yet.





↧
Viewing all 265 articles
Browse latest View live
Search