How to Avoid Being a Social Engineering Victim of Pig Butchering Cryptocurrency Fraud


As Crypto market grows it encourages threat actors to commit cyber crime. This leads security firms to be more vigilant about the emerging threats to protect their clients and their own infrastructure. Proofpoint, a well know security company has been tracking multiple threats known as Sha Zhu Pan, or “Pig Butchering” for past few months. According to the Proofpoint, these threats are typically managed by a large industry of professional fraud actors to lure a victim into depositing cryptocurrency into a fake cryptocurrency exchange to steal the money. Threat actors usually carry out these attacks using attractive platforms like dating apps, social media platforms, or some times through text messages. We created this post to help you learn about Pig Butchering Cryptocurrency Fraud, a cryptocurrency-based social engineering scheme and how to avoid being a social engineering victim and finally, how to prevent social engineering attacks in general. Let’s begin the post.

What Is Social Engineering

Social engineering is the art of psychological manipulation to exploit human errors to accomplish malicious activities. Social engineering tactics makes people to trust blindly and break security policies and procedures, this is mainly done by gaining the trust of an individual and unknowingly stealing sensitive information from them.

In this post we will discuss on a major social engineering attack which is exploited widely and how to avoid being a social engineering victim.

Cryptocurrency Frauds High in Markets: Pig Butchering

Crypto currency is the virtual currency which are encrypted by cryptography. Crypto currencies are not issued by any central authority and doesn’t exist in any physical form, they are maintained in a decentralized platform. One of the wildly exploited social engineering attack is the Pig Butchering Cryptocurrency Fraud.

This cryptocurrency-based social engineering scheme have stolen millions of dollars from multiple users.

What is Pig Butchering:

A conversation that is started from a text from a wrong number will lead to months of friendly conversation which eventually moves on to many serious topics on emotional scenarios, financial advices, etc., over a period of time you started trusting your new friend, and one day they inform you about a highly successful investment they did in a newly emerging cryptocurrency platform which is the future of crypto investments and recommends you to invest in it

See also  Step by Step Guide to Install Java on Ubuntu Linux

Initially, you are a bit hesitant, and you invest less, but the investments doubled. Wow! This currency is for real. Let me invest more. After investing a huge amount in crypto while waiting for it to get doubled you are realizing slowly no one responding and when you realized you have been scammed the threat actor deletes the website and moves on to their next victim.

You Have Been Scammed!!!! 

Proofpoint has shared a detailed article on this cryptocurrency-based social engineering scheme, Pig Butchering AKA Sha Zhu Pan.

 

See Also Secure Your Android Device From These Critical Flaws In Pre-Installed Apps

Now Let’s dig into the details of how the attacker lure their victims and gain their trust.

The name ‘Pig Butchering’ refers to how the scammers feed the victim(pig) with so many hopes and false promises and eventually make them ready for getting looted (Butchering).

Pig Butchering Cryptocurrency Fraud initially targeted the Chinese audience and then slowly moved to English-speaking countries.

Phase 1:Introducing the Treat Actor

The conversation mostly starts with an attractive polite stranger on the internet, they start with pleasantries and mind-capturing conversations while they complement, and empathize with the victim.

Slowly they start chatting for weeks and establish a strong emotional connection with the victim sharing their experiences and finer things in life. If the Victim is on social media apps like LinkedIn, Twitter, Instagram etc the threat actor will request the victim to connect over WhatsApp which is the more private and trustable platform. Most of the time they establish a romantic relationship with the victim and share racy “selfies” to make the victim reciprocate the same (which will be used in later stages for blackmailing).

As this conversation progresses and the attacker feels the trust with the victim is established, they will invite the victims to chat with their so-called ‘investment mentors’ on how to make more money and how the threat actor has created a lot of profit out of it.

Credits: Proofpoint

Phase 2: The Kind Uncle who helps you invest!

One the rapport is established the ‘investment mentor’ or the ‘kind uncle’ will send the victim cryptocurrency investing documents on how to set up coin base or crypto account. One of the integral parts of the scheme is to create a cryptocurrency wallet if the victim doesn’t have one. The scammers will work with the victim individually or ask them to join group chats mostly on WhatsApp, telegram and Discord where the victim meets so many people investing and making money as per the advice of the “Plan Analyst” the one who leads the group.

See also  1000 Business Worldwide Were Hit By Kaseya Supply-Chain Attack With REvil Ransomware

Ultimately after all the convincing, the victim will be led to fake crypto currency website or mobile applications and will be requested to purchase a small amount of crypto by the treat actors, this will be mainly on Tether (USDT) in crypto.com or  coinbase.com. The threat actor will make sure that the victim purchased by requesting a screenshot, the actors will specifically request to invest less than $1000. If the victim complies to all the requirements set by the treat actor, they will be provided with 10% to 20% reward which will be reflected immediately in their wallet.

Once the reward is received the ‘plan analyst’ will congratulate you and also inform you on the urgency on investing in crypto as it is a volatile market. Hence slowly step by step after investing in small amounts and getting rewards the attacker will urge you to invest in a huge amount, here the treat actors are putting victims into a behavioural pattern known as “classic conditioning” where the victims mind is trained on receiving the rewards. In this case the victim believes in attacker as he was receiving rewards from previous investments.

 

See Also What Is Proof Of Address? Why is Proof of Address Important?

An image of fake crypto website captured by Proofpoint

Phase 3: Fattening Up the Pig

Once the victim is convinced by the attacker and sees profits in their wallet, the trust also increases and they are ready to invest high, a.k.a Fattened up, the attackers will encourage in putting in large investments by taking a loan, sell stocks etc, and invest in the fake crypto.

Once the victim starts to worry, they will be asked to take out only small amounts and convince that the rest of the amount should not be taken out.

See also  How To Fix The 3 New Vulnerabilities In Lenovo BIOS?

In the end when the victim realizes that they have been scammed, the attacker deletes the website and starts hunting for other victims.

On the Killing Floor

Pig butchering type of scam is most of the time highly successful due to the intimate conversations with the victim which makes it more trustable. The empathetic and emotional manipulations and friendly conversation exploit the genuine feelings of the victim. The attacker often shares fake sad and emotional stories in order to gain trust and empathy from the victim.

The threat actors are highly trained not to click any links. When Proofpoint researchers shared URLs to trace the treat actor they were blocked immediately.

Credits: Proofpoint

As per the statistics shared by FBI In 2021 more that 4300 cases were received on crypto-romance scams which lead to more than $429 million in losses.

How to Prevent Social Engineering Attacks

The U.S. Federal Bureau of Investigation (FBI) have shared a few steps on How to avoid being a social engineering victim

  • Your financial details should never be shared to any stranger you have met online
  • Do not take advice from strangers and invest accordingly   
  • Never provide your personally identifiable information such as social security number bank details or other identification proofs under any circumstances to people over the internet.
  • Never fall for unbelievable profits on any trading sites.
  • Be cautious of people, emails, and texts where they urge you to invest anywhere.

Indicators of Compromise

Indicator Description
zvip[.]zone Pig   Butchering Domain
xtfkskpk[.]buzz Pig   Butchering Domain
meymytum[.]xyz Pig   Butchering Domain
vwtryf[.]xyz Pig   Butchering Domain
eumfpbva[.]xyz Pig   Butchering Domain
nhealcoin[.]cc Pig   Butchering Domain
zvip[.]zone Pig   Butchering Domain
hitbicvip[.]com Pig   Butchering Domain
hitbic[.]net Pig   Butchering Domain
oslint[.]com Pig   Butchering Domain
maskexc[.]com Pig   Butchering Domain
coinss[.]pro Pig   Butchering Domain
qklyz[.]com Pig   Butchering Domain
coinline[.]pro Pig   Butchering Domain
skgroup[.]vip Pig   Butchering Domain
galaxycoin[.]vip Pig   Butchering Domain
nhchain[.]vip Pig   Butchering Domain
lanbing[.]club Pig   Butchering Domain
fwhtoken[.]com Pig   Butchering Domain
s-coin[.]vip Pig   Butchering Domain
walletput[.]com Pig   Butchering Domain
okx-us[.]net Pig   Butchering Domain
mitokenex[.]com Pig   Butchering Domain
flyscoin[.]com Pig Butchering   Domain
autoecofxmarkets[.]com Pig   Butchering Domain
ensf[.]agency Pig   Butchering Domain
shopwse[.]com Pig   Butchering Domain
beybit[.]com Pig   Butchering Domain
bihuo[.]top Pig   Butchering Domain
bn93[.]com Pig   Butchering Domain
sklge[.]com Pig   Butchering Domain
tgbone[.]com Pig   Butchering Domain
rkez[.]xyz Pig   Butchering Domain
bitget-tw[.]com Pig   Butchering Domain
cme-cn[.]com Pig   Butchering Domain
kucoinusa[.]com Pig   Butchering Domain
266wrd[.]com Pig   Butchering Domain
financeaka[.]cc Pig   Butchering Domain
ettsmc[.]ltd Pig   Butchering Domain
bilinkbitex[.]com Pig   Butchering Domain
engiegpg[.]com Pig   Butchering Domain
aax[.]news Pig   Butchering Domain
ftxcn99[.]com Pig   Butchering Domain
pinduoyu[.]com Pig Butchering   Domain
hkdbitexchange[.]com Pig   Butchering Domain
acefinex[.]com Pig   Butchering Domain
acefinex[.]net Pig   Butchering Domain
acefinex[.}vip Pig   Butchering Domain
eumfpbva[.]xyz Pig   Butchering Domain
meymytum[.]xyz Pig   Butchering Domain
okx-us[.]net Pig   Butchering Domain
s-coin[.]vip Pig   Butchering Domain
vwtryf[.]xyz Pig   Butchering Domain
xtfkskpk[.]buzz Pig   Butchering Domain
mitokenex[.]com Pig   Butchering Domain

Conclusion

See Also Step by Step Procedure to Set Up Open VPN on Raspberry Pi:

The above post would have given a detailed idea of how threat actors can impact a common man, we also learned how to avoid being a social engineering victim. Everyone should be always alerted to their surroundings and very careful while sharing personal information on the internet.

Leave a Reply

Your email address will not be published. Required fields are marked *