Fraud Ecosystem

5 automated security scanners

Money Mule Networks

Purpose: The Money Mule Networks Scanner is designed to identify and analyze potential fraud ecosystems involving money mules by detecting activities related to mule recruitment, cashout methods, and transfer techniques through the analysis of domain content, company information, and specific keywords.

What It Detects:

Recruitment Indicators: The scanner looks for phrases such as “earn extra income,” “work from home,” or “part-time job opportunities” to identify potential mule recruitment activities. It also checks for language related to payment processing, financial transactions, and money transfers that may indicate fraudulent practices.
Cashout Methods: Detects mentions of specific cashout methods like Western Union, MoneyGram, prepaid cards, or cryptocurrency wallets, along with instructions on how to receive payments or transfer funds securely. Suspicious references to offshore accounts or international transactions are flagged as well.
Transfer Techniques: Identifies patterns related to money laundering techniques such as layering, smurfing, and structuring, including complex financial operations involving multiple parties or jurisdictions. Instructions on how to split payments or use different payment methods to avoid detection are also noted.
Keyword Matching: Searches for user-provided keywords that are relevant to mule activities within the domain content, ensuring their context is not benign. Suspicious usage of such keywords indicative of fraudulent intent is flagged.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
keyword (string): Specific keywords related to mule activities (e.g., “earn extra income”)

Business Impact: This scanner is crucial for identifying potential fraud and safeguarding financial transactions against money mule involvement, which can significantly impact the security posture of organizations by preventing fraudulent activities before they escalate into larger issues.

Risk Levels:

Critical: The scanner identifies clear indicators of illegal or high-risk activities that could lead to significant legal consequences or substantial financial loss if not mitigated promptly.
High: The presence of recruitment for potential mule roles, cashout methods involving high-risk transactions, and transfer techniques that suggest complex money laundering practices are flagged as high risk.
Medium: Recognizes less clear indicators but still suggests a need for investigation, such as ambiguous job postings or suspicious financial instructions without overt illegal activity.
Low: Informational findings suggesting benign usage of keywords not directly related to mule activities may be considered low risk if they do not indicate fraudulent intent.
Info: These are non-critical findings that might suggest some form of suspicious behavior but do not pose immediate or severe risks, such as minor mentions unrelated to financial transactions.

Example Findings:

The scanner flags a domain prominently advertising “work from home” job opportunities with minimal effort and high rewards, suggesting potential recruitment for money mule activities.
A company page mentioning “offshore accounts” in the context of secure payment methods could indicate involvement in illicit financial practices.

Fraud-as-a-Service Operations

Purpose: The Fraud-as-a-Service Operations Scanner is designed to detect phishing services, scam frameworks, and automated fraud by analyzing domain reputation, IP exposure, known vulnerabilities, and dark web activities. This tool helps identify malicious actors leveraging compromised infrastructure to conduct fraudulent operations.

What It Detects:

Phishing Services Detection: Identifies domains associated with phishing activities, looking for common phishing-related keywords in domain names and content.
Scam Framework Identification: Detects known scam frameworks and tools used by malicious actors by analyzing domain reputation to identify suspicious activities.
Automated Fraud Operations: Identifies automated fraud mechanisms such as botnets and credential harvesting, monitoring for indicators of command and control (C2) infrastructure.
Known Exploited Vulnerabilities: Checks domains against the CISA Known Exploited Vulnerabilities (KEV) list to identify if known vulnerabilities are being exploited on the domain.
Dark Web Activities: Searches dark web sources for mentions of the target domain and company name, detecting potential data leaks, breaches, or unauthorized access attempts.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
keyword (string): Specific keyword related to the fraud operation (e.g., “phishing”)

Business Impact: This scanner is crucial in enhancing cybersecurity by proactively identifying and mitigating threats posed by fraudulent operations, which can lead to significant financial losses and damage to brand reputation if not detected early.

Risk Levels:

Critical: Conditions that directly lead to critical severity include the discovery of active malware infections or unauthorized access to highly sensitive data.
High: High risk conditions involve exposure of personal information or intellectual property on dark web platforms, indicating a significant potential for identity theft and corporate espionage.
Medium: Medium risk conditions pertain to domains with multiple exposed services in Shodan, suggesting compromised infrastructure that could be used as a pivot point for further attacks.
Low: Low risk conditions are those where minimal exposure or indicators of compromise have been found, indicating less severe threats but still requiring monitoring and reporting.
Info: Informational findings include the detection of common phishing keywords in domain names, which may not pose immediate risks but should be monitored for trends that could indicate evolving threats.

Example Findings:

A domain is identified as hosting multiple phishing pages, containing keywords such as “login,” “banking,” and “reset password.”
An IP address associated with the domain reveals a Shodan entry for an exposed Apache server running outdated software, indicating potential vulnerabilities being exploited.
Dark web monitoring alerts that personal data belonging to the company’s customers has been leaked on forums discussing illegal data trades.

Account Trafficking

Purpose: The Account Trafficking Scanner is designed to detect account sales, credential stuffing services, and advanced threat operations (ATO) methods by analyzing various data sources including Shodan, VirusTotal, CISA KEV, and dark web feeds. It aims to identify malicious activities related to compromised accounts and credentials.

What It Detects:

Account Sales Indicators: Patterns indicating the sale of user accounts or credentials, such as mentions of “buy accounts,” “sell user data,” and “account marketplace.”
Credential Stuffing Services: Detection of services offering credential stuffing attacks, including references to “credential stuffing service,” “login brute force,” and “password cracking.”
Advanced Threat Operations (ATO) Methods: Identification of techniques used in ATO, such as phishing campaigns and malware distribution through mentions like “phishing campaign,” “malware distribution,” and “command and control server.”
Exposed Services and Vulnerabilities: Detection of exposed services and known vulnerabilities that could be exploited for account trafficking, including specific CVEs and unauthorized access points.
Dark Web Activity: Monitoring dark web forums and marketplaces for mentions of compromised accounts or credentials, such as “dark web marketplace,” “breached data,” and “stolen credentials.”

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
keyword (string): Specific keyword related to account trafficking or credential stuffing (e.g., “credential stuffing”)

Business Impact: This scanner is crucial for organizations as it helps in identifying potential security breaches and malicious activities that could lead to data theft, financial loss, and legal repercussions. It enables proactive measures to be taken against account trafficking and credential stuffing, enhancing overall cybersecurity posture.

Risk Levels:

Critical: Conditions where critical vulnerabilities are identified or unauthorized access is confirmed through exposed services.
High: Presence of indicators for advanced threat operations (ATO) methods such as phishing campaigns or malware distribution on the dark web.
Medium: Exposure of known vulnerabilities that could be exploited without direct access to critical systems but still pose a significant risk.
Low: Informal mentions of compromised accounts or credentials, which may require further investigation for confirmation.
Info: General activity related to account sales and credential stuffing services, requiring basic monitoring and reporting.

If the README doesn’t specify exact risk levels, infer them based on the scanner’s purpose and impact.

Example Findings:

A detected vulnerability in a company’s network identified through Shodan indicating potential data exposure (Critical).
Evidence of ongoing phishing campaigns mentioned on the dark web related to stolen credentials from multiple organizations (High).

Fake Document Services

Purpose: The Fake Document Services Scanner is designed to identify potential fraud within an ecosystem by analyzing various data sources to uncover suspicious activities related to the creation of fake IDs, attempts to bypass KYC processes, and strategies for evading verification mechanisms. This tool helps organizations detect potential fraudulent practices and improve their security posture.

What It Detects:

ID Creation Indicators: The scanner detects methods used for creating fake IDs through keywords such as “fake ID,” “forged documents,” and “counterfeit IDs.” It also identifies services offering document fabrication via web content analysis.
KYC Bypass Methods: The scanner recognizes phrases indicating attempts to bypass KYC checks, including “bypass KYC,” “skip verification,” and “fake proof of address.”
Verification Evasion Techniques: Patterns suggesting evasion of verification processes are detected, such as “verification loophole,” “fraudulent verification,” and “avoid verification.”
Threat Intelligence Indicators: The scanner identifies known exploited vulnerabilities (CVEs) and malicious activities using threat intelligence feeds. It also analyzes domain reputation through VirusTotal API to identify suspicious domains.
Dark Web Activity Monitoring: The scanner scans dark web sources for mentions of the target company or domain in relation to fraudulent activities.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
keyword (string): Specific keyword related to the type of fraud being investigated (e.g., “fake ID”)

Business Impact: This scanner is crucial for organizations operating in sectors where identity verification and KYC compliance are critical, as it helps identify potential fraudulent practices that could lead to significant financial losses and legal repercussions.

Risk Levels:

Critical: Findings include evidence of direct exploitation of known vulnerabilities affecting the core functionality of the system or significant data loss risks.
High: Findings indicate a high risk of unauthorized access, data theft, or other malicious activities that could significantly impact business operations and reputation.
Medium: Findings suggest potential security weaknesses that could be exploited by low-skilled attackers with limited resources, leading to partial data exposure or minor service disruptions.
Low: Informal findings indicating minor issues such as misconfigurations or outdated software versions that do not pose significant risks but are still recommended to be addressed for overall system improvement and compliance.
Info: Non-critical findings providing general information about the environment, which does not directly affect security posture but can be useful for continuous monitoring and improvement initiatives.

Example Findings:

The domain “acme.com” contains pages with content suggesting the creation of fake IDs, specifically mentioning “fake ID,” “forged documents,” and “counterfeit IDs.”
A subdomain “verify.acme.com” exhibits signs of bypassing KYC processes by offering services that claim to skip verification checks.

Carding Operations

Purpose: The Carding Operations Scanner is designed to identify potential fraudulent activities within a specified domain by analyzing various threat intelligence feeds and web sources. It helps detect card data trafficking, cashout methods, testing services, and other related indicators of illegal activities.

What It Detects:

Card Data Trafficking Indicators: Detection of patterns indicative of card data being sold or traded, as well as identification of phrases related to the illegal transfer of payment information.
Cashout Methods: Recognition of terms associated with converting stolen funds into usable cash, including money laundering activities and other financial fraud methods.
Testing Services: Detection of services that offer testing for carding operations, such as stress testing and vulnerability assessments, and identification of phrases related to penetration testing and security assessment services.
Threat Intelligence Indicators: Analysis of threat intelligence feeds like Shodan, VirusTotal, CISA KEV, and AbuseIPDB to identify malicious activities and known vulnerabilities and exploits that could be used in carding operations.
Dark Web Activity: Scanning dark web sources for mentions of the specified domain or company name related to fraudulent activities, including identification of patterns indicative of illegal activities on the dark web.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
keyword (string): Specific keyword related to carding operations or fraud (e.g., “card data”, “cashout”)

Business Impact: This scanner is crucial for organizations aiming to maintain a secure and compliant environment, as it helps in identifying potential threats posed by card data trafficking, cashout methods, and fraudulent activities that could lead to significant financial losses and legal repercussions.

Risk Levels:

Critical: Conditions where there is clear evidence of illegal card data trafficking or other high-risk fraud activities directly impacting sensitive information and security protocols.
High: Situations involving potential exposure to unauthorized access to payment systems, unclear but suspicious financial transactions, or involvement in testing services that could be misused for illicit purposes.
Medium: Findings related to vague suspicions of fraudulent activities or minor deviations from typical business practices that might require further investigation to confirm risks.
Low: Informal assessments indicating minimal risk such as isolated mentions of generic terms without concrete evidence of illegal activity.
Info: Non-specific findings that do not directly indicate malicious intent but could be indicative of potential future issues or areas for improvement in security practices.

Example Findings:

“We have detected unauthorized access to our card data systems.”
“Our testing services include penetration testing for credit card vulnerabilities.”