Gary Warner’s Post

IRGC getting kicked out of Canada. https://lnkd.in/ezP4ay57

On Fridays I meet with Nicole White, one of the analysts in the UAB Computer Forensics Research Lab, to go through her discoveries as she investigates #CryptoScams. Today I asked her what she thought it meant when the URLs being shared on #Facebook didn't include a referring URL. How do they get credit for referrals if they don't use a customized ?ref=mynamehere or some other affiliate indicator? Nicole told me that these are indicators of a "Bounty Program." Bounty Programs don't pay a percentage for new investments the way a typical crypto affiliate program does. Instead they pay a flat rate for each screenshot that you send them of the ads that you have placed on their behalf. I asked for an example, and Nicole found one in about thirty seconds. This scam program tells "Bounty Program" members that they can earn up to $500 for a 3 minute video about AutoHashMining[.]com, or they can earn up to $5 per comment for commenting on other people's YouTube videos about investing, depending on how popular the video is. They can also earn up to $50 for making a post on Facebook, VK, or Sina Weibo. If you'll post a fake review for them on TrustPilot, you can earn $2 per review. (They currently have more than 1500 Trustpilot reviews.) Sharing on Telegram or WhatsApp to a group with at least 20 members can also earn up to $500. Of course each of these is a RANGE. From 10 cents to $500, as an example. Now consider someone who may be unemployed and living in a country where the average wage is less than $5 per day. How many posts would you be willing to make? See the attached PDF for more from this particular scam program. AutoHashMining dot com is registered at Enom and has their hosting protected by GENIUS GUARD LTD 's reverse proxy services.

Another $50 Million #BEC case ... this time from the Eastern District of New York. Nigerian spammers compromised (mostly) law firm accounts and caused payments to be mis-directed. Co-conspirators from Nigeria living in Chicago and Atlanta/Wisconsin helped with setting up the accounts to catch the funds. One oddity in this one ... the 79 year old woman from Germany who came to New York and helped launder funds through her newly founded furniture business. (She was sentenced to time-served, asked to forfeit $2.3 Million, and deported back to Germany.) More details on the CyberCrime & Doing Time blog: https://lnkd.in/eNYxBQjq

The number one financial cybercrime in America today is the Crypto Investment Scam. It steals more money than any other type of cybercrime. Given that the FBI's IC3.gov, the FTC's Consumer Sentinel, and the FinCEN Financial Crimes Enforcement Network all agree with that assessment, why are we not applying more pressure towards it's elimination? Today, China launched a nationwide awareness and policing campaign against cyber fraud that calls on every school, business, community, media outlet, and police unit to address this scam. But in the USA, we can't even interest law enforcement in taking down the domain names that are actively stealing money from our citizens. As China educates their citizens and breakups the money mule networks (they call them "running ants") we should anticipate MORE crime coming our way. We are not ready. Help us shut down these websites. Help us get your elected officials interested in this problem. Take time to reach out to community centers, senior citizen groups, small business organizations. How can you help make our citizens more resistant to this type of crime? Thanks for all of the assistance we've received so far!

Intelligence for Good continues to share each week twenty websites that are being used to sell Schedule II Opioids without a prescription. These domains need to be removed from the Internet.

Lockbit 3.0 is claiming to have breached the U.S. Federal Reserve Bank system and stolen 33 TB of data!

Today I was writing a piece for my Cybercrime & Doing Time blog about a curious number I saw while reviewing a UN Office of Drugs and Crime report about Chinese money-laundering. The report mentioned that China had removed 8.36 million fraud related domain names. That number seemed RIDICULOUSLY high to me! So, I dug in, with some help from my friends at CAUCE - the Coalition Against Unsolicited Commercial Email. What I found was that they PROBABLY meant websites instead of domain names, but as John Levine and I searched through the Chinese Ministry of Public Security website, I found some fascinating facts about China's role both as the source of so much of this online fraud, but also what it looks like when a totalitarian state declares war on fraud, as they just did TODAY. China announce today a month-long "National Anti-Fraud Action" which will use a "Five-In" approach, meaning that Chinese citizens will see and be encouraged to spread anti-fraud educational messages in five areas: Community, Rural Areas, Families, Schools, and Businesses. The push is to help people learn how to not become a Tool or Accomplice to the fraudsters while setting off "a new wave of anti-fraud among the whole people and the whole society." I would LOVE to get my hands on these training documents if anyone in my network can help! (Which of you secretly work for the Chinese MPS? Please reach out, haha!) #Cyberfraud #China #OrganizedCrime #CryptoScam #InvestmentScam #Myanmar #PigButchering #OperationShamrock To see more details, please visit my Cybercrime & Doing Time blog for the story: "Millions and Millions of Fraud Domains: China attacks Illegal Gambling and Telecom Fraud" at:

I know what I’m doing tonight! I’ve been anticipating the arrival of this book for months, so this may be an all-night reading evening! Update: just finished — Geoff White! Truly enjoyed the new book! While there are certain crypto stories that “must be told” and have been told ad nauseum, I appreciated Geoff’s insistence in diving deeper into some of the cases that have NOT been well-covered. He doesn’t just regurgitate the well-known facts of the famous cases. He puts his investigative journalism hat on and gets the interviews and details that no one has yet revealed. I was honored to be interviewed as one of his subjects, but I was thrilled by the fact when I didn’t know an answer, Geoff would sometimes ask “Who would?” and many of those people are quoted in the book as well. While there are some crypto stories — after all a key premise of the book is that crypto enables money-laundering at unfathomable scale — I appreciate the pre-crypto build up. Geoff teaches us the fundamentals of the three stages of money laundering starting with Pablo Escobar, Miami’s Cocaine Cowboys and the Din sisters. Having covered the basics, he then shows how money laundering can be the breakthrough charges in otherwise unchargeable offenses as he examines the role money laundering plays in human trafficking and sexual abuse with BackPages and their nest of shell companies, trying to hide their money from Visa, AmEx, and MasterCard. Welcome to Video introduces crypto and the laziness in OpSec that the ease of crypto can lead to. But this is not a #Crypto book. It is clearly a #MoneyLaundering book. I especially appreciated how he used the evolution of West African Organized Crime and the role of the #BlackAxe in #BEC and money laundering. His insights into the TRUST network that such orgs create that makes global money laundering truly possible was a key insight. His praise for Ireland’s approach and the great work the #Garda and their Economic Crimes team is doing is something I strongly agree with! No one does Money Mule tracking better than Michael Cryan and his team, but Geoff puts it in the context of the overall placement / layering / integration structure so clearly. If people take that away from the book, maybe we will finally see the rest of the world care about money mules the way Ireland does! In the end, as I was reading the Axie Infinity hack story, I thought back to Geoff’s RSA Conference presentation. I’ve told many of the stories in this book myself in presentations and in my blog - but Geoff is not just an excellent investigative journalist. He’s a master story teller. In many of the stories I learned facts I didn’t know, but even when I did know all the facts, it was just a pleasure to read the story the way Geoff told it. What are you waiting for? Go buy your own copy right now!!! #bookreview #aml #moneylaundering #cybercrime #Cryptocurrency #bitcoin

This week's #TwentyTargets: CryptoScam edition is once more reminding us that while many of these scams start using the Chinese #PigButchering playbook, there are many other paths into #cryptoscams. Please take some time to consider whether you could help us to terminate these domains which are largely operated by Chinese organized crime groups who have conscripted #HumanTrafficking victims to work as #Cyberslaves. As you review the "False Claims" slide that accompanies each of the twenty targets for takedown, you'll see that many of them have messages from #Facebook groups where someone is sharing the address of the #InvestmentScam website followed by a "?ref=username." These are examples of crypto scams that are being pushed on social media in large groups that seem dedicated to helping investors find groups that really work. The person advertising the site has been told that they will receive a commission each time they successfully sign up someone using their referral code. While these groups are a never-ending stream of crypto scam website addresses, we've begun to see a new trend. People (often posting in Chinese, or posting from +62 Indonesia telephone numbers) are asking for people who can help launder USDT through their financial and crypto addresses. Chinese money-laundering rings (called Motorcades 車隊) and USDT to Fiat exchange (卡接回U) services are constantly needing people who will use their own accounts to convert USDT. (This system is sometimes called USDT Running Points (USDT跑分.) According to the UN Office on Drugs and Crime, crypto investment and gambling scammers are paying as much as a 40% commission to get their USDT cleaned back into fiat! Typical message examples: * I need 80 Binance users - Daily salary is $50 * Monetizer for USDT ERC20 deal - wallet to wallet or MT103 transfer needed urgently * 尋求代購USDT（茶水費燙嘴），或是你手頭上有U我們高價收，先款後U一筆一回（可同台交付） * 40000 rmb available in alipay need usdt * selling 4000K usdt Telegram is also overflowing with channels dedicated to USDT-to-Fiat money laundering. Many of the channels will contain the "USDT running points" in their Chinese channel name, such as "星辰支付宝博彩口令洗资USDT跑分" (Xingchen Alipay gambling password laundering USDT running points) with 3152 subscribers. Another channel we found is actively recruiting "Internet police, fraud investigators, mobile phone and bank employees" anyone who can access accounts - claiming that the "demand is huge" for their services. Another is recruiting people to process "gambling and pornography" payments through their Alipay account. The "Running points" channels are similar to our crypto investment scams, often offering a 4% daily return on investment (which works out to an annual rate of something like 1460% interest?) But they provide the scammers access to their Alipay accounts, linked to Chinese bank accounts, as part of the process. #MoneyLaundering #USDT #ElderFraud #RomanceScams #AML