Pig Butchering, also known as Sha Zhu Pan and CryptoRom, is a long-running scam with a new twist. It’s now being offered as a download from official Apple and Android app stores, making it appear more legitimate to potential victims.
The scam is a form of romance scam where victims are gradually drawn into false cryptocurrency deals and defrauded. It relies on building trust through social engineering, and has its roots in China. The scam is now run by well-organized gangs, with a hierarchical structure that includes head office, front desk, tech team, and finance team
It originated in China. When the Chinese authorities clamped down, the gangs decamped to places like Cambodia. Now, according to an analysis from Sophos, the gangs are well organized but as ugly as the scam. At the top of the hierarchy is the ‘head office’ which does supervision and money laundering.
The scam itself is subcontracted to affiliates, which have a front desk handling staffing, a tech team handling the technology involved, and a finance team looking after the money. Profits tend to be divided 60-40 – with 40% going to the head office.
The bottom rung of the hierarchy consists of keyboarders who trick the targets, often victims themselves who were lured in with the promise of earning money or threatened with violence. The new danger is the success of these gangs in getting malicious apps into the official app stores. In two examples, the app passed Apple’s review by initially communicating with a benign back end, but later switched to a malicious server after the app was accepted and launched.
The new danger exposed by Sophos is not the scam (that’s not new) but the criminals’ success in getting malicious apps into the official app stores (Ace Pro and MBM_BitScan into the App Store, and BitScan into Google Play). This is not uncommon with Google Play, but unusual with Apple. In two separate examples that by-passed Apple’s App Store review, a legitimate-looking app initially communicates with a benign back end. Nothing malicious can be seen, so the apps passed Apple’s review.
Only after the app is accepted, downloaded, and launched does the developer switch domains, from the benign back end to a malicious server that delivers the malicious content.
“When we originally began investigating CryptoRom scams targeting iOS users, the scammers would have to persuade users to first install a configuration profile before they could install the fake trading app,” comments Jagadeesh Chandraiah, senior threat researcher at Sophos. “This obviously involves an additional level of social engineering—a level that’s hard to surmount.”
Many potential victims would be ‘alerted’ that something wasn’t right if they cannot directly download a supposedly legitimate app. But by getting an application into the App Store, the scammers have vastly increased their potential victim pool, particularly since most end users inherently trust Apple.
“Both apps are furthermore unaffected by iOS’ new Lockdown mode, which prevents scammers from loading mobile profiles helpful for social engineering,” continued Chandraiah. “In fact, these CryptoRom scammers may be shifting their tactics – that is, focutilizing on bypassing the App Store review process – in light of the security features in Lockdown.”
This scam requires extensive social engineering, such as being approached via a dating app and then moving to WhatsApp. The victim is often lured into a fake cryptocurrency investment, which gradually takes their money. In one case, the victim was based in Switzerland. The scammer or scammers utilized a manufactured profile of a woman based in London, with a full and compelling Facebook profile complete with professional or stolen location and lifestyle photos.
“After establishing a rapport, the criminals behind the profile told the victim that ‘her’ uncle worked for a financial analysis firm, and invited the victim to do cryptocurrency trading together.” It was at this point that the victim was introduced to the fake application in the app store.
In such cases, a degree of patience is still demonstrated by the attackers. Crypto investment begins slowly, and the victim can even make withdrawals from the crypto account. But the investment goes straight to the criminals. By the time the victim realizes that something is wrong, both the money and the scammers are gone.
This scam, says the Sophos report, “is a well-organized, syndicated scam operation that employs a combination of romance-centered social engineering and fraudulent crypto trading applications and websites to lure victims and steal their money after gaining their confidence.” The worry for the future is that AI technology such as ChatGPT could make social engineering even more convincing and accessible to less sophisticated criminals.
Go to Source
Author: Kevin Townsend
