Search leads to cybercriminal scam creator

Cybersecurity vendor Sophos said it has uncovered the likely offender behind an extensive scheme designed to scam cybercriminals.

Part three of the company’s Scammers Who Scam Scammers on Cybercrime Forums series outlines how researchers were able to track the origin of more than 20 fake criminal marketplaces. After discovering a surface website designed to mimic Genesis Marketplace (which offers access to data including stolen credentials, cookies and digital fingerprints gathered from compromised systems) researchers uncovered the additional fake marketplaces dating back to Q3 2021. All of these fake sites appeared to be run by a user identified as ‘waltcranston’, a likely nod to the Breaking Bad TV series.

“While investigating this huge sub-economy of scammers scamming other scammers, we examined about 600 scams of varying types. Out of all the scams investigated, this operation stood out for its sheer scope and intricacy,” said Matt Wixey, senior threat researcher, Sophos.

“The scammer advertises the fake marketplaces on Reddit and replicates not just Genesis, which was the first scam site we ran across, but numerous other prominent or defunct marketplaces, such as Benumb, UniCC and PoisOn. While at a technical level these scam sites are not sophisticated, the scam operation has been highly successful. In fact, seven of these fake sites are still active and, to date, the cryptocurrency wallets associated with the scams have received at least $132,000,” he said.

All 20 of the fake sites followed a similar scheme. Activation of an account on a fraudulent version of a dark web marketplace is offered for $100. Potential users expected their $100 would be deposited in either Bitcoin or Monero, and they would receive activation credentials. However, as part of the scam, once these criminals paid for access, their account would fail to activate.

Sophos X-Ops: the deposit demand from the fake Genesis site.

A common denominator among the 20 fake sites was a link to a website called darknet[.]markets — a site that lists dark web criminal marketplaces for visitors interested in drugs sales, carding and cryptocurrency exchanges. This site ultimately led Sophos to a criminal forum called Café Dread — and a user going by the name of waltcranston.

Sophos X-Ops: a post on Dread Café by waltcranston (since deleted).

“We started searching Dread for any mentions of the marketplaces mentioned on the darknet[.]markets, and we found multiple posts by the handle waltcranston talking about dark web marketplaces, as well as discussing how to scam people and recommending other users set up phishing sites. His own website, which sells meth, also shared some similarities with the fake marketplaces. We even found posts by Dread users who fell for the scam websites, and accusations by a Dread user that waltcranston was the culprit behind the scheme,” Wixey said.

“While we can’t be 100% certain that [whoever is] behind the handle waltcranston is indeed the culprit, there is strong circumstantial evidence. The entire operation and our investigation is an example of how much rich intelligence there is about cybercriminals hidden in these scams against other scammers, which the security community can leverage to help develop stronger defences.”

Image credit: iStock.com/BeeBright