Researchers Uncover a Nigerian Hacker’s Pursuit of his Million Dollar Dream

Social engineering-driven malware threats continue to be a big
threat, but new research details how cybercriminals profit off such
schemes to launder hundreds of thousands of dollars from stolen
credit cards of unsuspecting victims.

Cybersecurity firm Check Point Research, in a report published
today and shared with The Hacker news, uncovered the digital trail
of a Nigerian cybercriminal, who went by the name of “Dton” and
targeted hundreds of thousands of people under the moniker of “Bill
Henry” by sending them malicious emails with custom-built
malware.

The company said it disclosed the findings to concerned Nigerian
and international law enforcement authorities for further action.

A multi-stage criminal scheme

The operation began with Dton buying stolen credit card details
from Ferrum Shop, an online marketplace that sells over 2.5 million
stolen credit card credentials, and then charging them each $550
each to fraudulently net more than $100,000 in illicit
transactions.

“During the years 2013-2020, the account he regularly logs into has
been used to purchase over $13,000 worth in stolen credit card
credentials,” Check Point noted.

Subsequently, the researchers found that Dton’s monetizing cyber
crimes were no longer dependent upon buying stolen credit cards.
Instead, he started collecting this data himself, for which he
purchased bulk email lists of new victims and malicious tools,
including keyloggers (AspireLogger) and remote administration tools
(RATs) such Nanocore^[1] and AZORult^[2], a family of spyware
that steals information and is used to download additional
malware.

In the next step, Dton orchestrates a RAT-spamming operation,
wherein the custom-built malware is disguised as innocuous email
attachments, and sent out to each of the email addresses, thereby
harvesting user credential details without the recipients’
knowledge.
The RATs contain hard-coded credentials for a single Yandex mail to
which all the aggregated stolen victim data is sent to.

But Check Point researchers found a twist in the criminal’s
modus operandi: “When business with someone goes well, Dton infects
them with a RAT just in case it later turns out to be useful; when
business with someone goes less than well, Dton resolves the
dispute by reporting them to the Interpol.”

Protect Yourself from Phishing Attacks

It’s no surprise that bad actors are continually finding new ways
to trick consumers into providing remote access to their computers
to steal information. By combining sophisticated social engineering
techniques with information already available about the target from
other sources, the attacks have proven to be an easy vector to
bypass security barriers.

The ever-evolving sophistication of social engineering scams
underscores the need for preparedness and practicing good security
hygiene^[3]. It’s essential that
accounts are secured with two-factor authentication and be vigilant
when it comes to opening emails and attachments from unknown
senders.