Security researcher Radek Jizba from ESETResearch has revealed the existence of a highly sophisticated tool known as Telekopye. This tool enables criminals to create convincing phishing websites, emails, SMS messages, and more.
Neanderthals, a group of threat actors, have been using Telekopye to present themselves as a legitimate company and operate within a structured framework. Aspiring members are recruited through underground forums and gain access to specific Telegram channels, where they can communicate and monitor ongoing operations.
The ultimate goal of the Neanderthals is to commit one of three types of scams — seller, buyer, or refund. Seller scams involve duping unsuspecting victims into buying nonexistent items, while buyer scams involve impersonating buyers to trick merchants into disclosing financial information. Refund scams occur when Neanderthals mislead victims into believing they are offering a refund only to deduct the same amount of money again.
The Neanderthals use various strategies to carry out these scams successfully. For example, when attempting a seller scam, they prepare additional photos of the non-existent item and manipulate internet images to make reverse image searches more difficult. Buyer scams require careful planning and research, with the Neanderthals tailoring their approach based on factors such as gender, age, experience in online marketplaces, ratings, and reviews.
In addition to these scams, the Neanderthals also engage in real estate fraud, creating fictitious apartment listings. To remain anonymous, they use VPNs, proxies, and TOR, making it difficult for authorities to track them down. This revelation by Radek Jizba sheds light on the sophisticated tactics being employed by criminals in the realm of cybercrime.
