Tracking Adversaries: GreenMwizi, Kenyan scamming campaign using Twitter bots

-

 Images made with Bing Create AI

Prologue
I find uncovering new campaigns and sharing research on novel threats is one the most enjoyable parts of my job as a CTI researcher. Especially the types of threats not many other researchers really spend much time investigating, or at least those who do rarely disclose their findings publicly. My investigation on the RedZei group is also an example of this.

Background
I have recently been investigating a financially motivated threat actor I've dubbed "GreenMwizi" that I believe to be from Kenya. They have setup a dozen fake Booking.com Twitter accounts and are currently targeting users who make public complaints. The main aim of these scammers is to socially engineer users over the phone into sending them funds via Remitly, an international money transfer service. By interacting with the scammers myself I was able to find out their phone number and trace their IP address and device information.

This type of activity is extremely common on Twitter. Users should always do their due diligence if they respond to an "official" account replying to them. Ever since Elon Musk decided to remove the blue verification icon from many official Twitter accounts, this issue has been exacerbated. Organizations whose users rely on Twitter to communicate with them should be proactively monitoring for these types of scammers to prevent them from being victimized. Now more so than ever, since Elon Musk's Twitter is failing to respond to the bot issues such as this themselves.

About GreenMwizi Campaigns
This investigation started when a friend noticed one of the fake accounts replying to a user on Twitter. Here (see Figure 1) is an example of how this scam begins by a target being lured into the Twitter direct messages (DMs).

Figure 1: Booking.com scammer replies on Twitter

I decided I wanted to learn more about how this scam works. Whether the scammers send a phishing link or something. I've personally not come across Booking.com scammers before, but I can imagine credentials to an account could be used to steal information and fraud. So, to learn more, I DM'd the scammer after they replied to me.

Figure 2: Twitter DMs with the scammer begin

I pretended to be having issues with Booking.com so I could see an example of what they say in the Twitter DMs. They asked for a phone number and asked to chat over WhatsApp and also for a Booking.com reference number. They then tried to call me via WhatsApp a couple times (see Figure 3), but I did not pick up at that time because I just wanted to get their phone number.

Figure 3: Two attempts at a WhatsApp call from the scammer

Notably, the threat actor's mobile number had a +254 extension, which is for Kenya. Also, they had "Remitly ✅" in their WhatsApp status (see Figure 4). A quick Google Search found that Remitly is an international money transfer services, similar to Western Union or Wise. 

Figure 4: Remitly was set as their WhatsApp status

Searching Twitter some more uncovered that this account was part of a dozen connected Twitter accounts all posing as Booking.com and replying to hundreds of Twitter users who have complained on the site (see Table 1). I noticed the reuse of the same text in replies and also the name "CJ" by several of these accounts in replies to users as well. Paired with the timing, I assessed with high confidence these are almost certainly under the control of the same adversary. Also, for the record, I have reported all of these to Twitter.

Joined URL Name
February 2023 https://twitter.com/__bookingcom_ Mitchell
March 2023 https://twitter.com/bookingcom_2 CJ
March 2023 https://twitter.com/bookingcomm
March 2023 https://twitter.com/ibookingcom Ha
March 2023 https://twitter.com/booking_com2 CJ
March 2023 https://twitter.com/bookingcomdesk CJ or GL or Tz
April 2023 https://twitter.com/bookingcom_A Jm or SH
April 2023 https://twitter.com/1_bookingcom
April 2023 https://twitter.com/BookingComUR Josphat
May 2023 https://twitter.com/bookingc0m__ MJ
May 2023 https://twitter.com/bookingcomla Ferguson
May 2023 https://twitter.com/bookkingcom

Table 1: An array of recently created fake Booking.com Twitter accounts

 Another interesting thing I noticed was that one of the fake Booking.com accounts also had the wrong Twitter bio. This one was instead related to MoneyGram, which is potentially another type of scam this adversary runs.

Figure 5: MoneyGram-themed fake Booking.com account

Tracing GreenMwizi
By doing a little social engineering of my own against the scammers, I was able to get detailed device information from their mobile phone, further confirming their location to be in Kenya (see Table 2). 

Type Device Information
IP Address 154.123.56.191
Country Kenya, Nairobi
Browser Chrome Mobile (94.0.4606.85)
Operating System Android 11
Device Infinix Hot 12i
User Agent Mozilla/5.0 (Linux; Android 11; Infinix X665) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 Mobile Safari/537.36
Host Name kiboko.telkom.co.ke
ISP JAMBONET
Phone Number +254 771 609283

Table 2: Threat actor's device information

Finally, to summarize what I've uncovered about GreenMwizi's campaign so far, I used the Diamond Model. Seeing as this specific campaign has not yet been covered yet in open sources, as it is fairly new, I created this model to hopefully help other researchers and analysts track them.

Figure 6: GreenMwizi Diamond Model

Courses of Action

To impose cost against these threat actors, I would recommend that:
  • Twitter takes down these Booking.com impersonating accounts and bans the threat actor's registration details, such as phone numbers, IP addresses, or email addresses
  • Mobile carriers should also block the GreenMwizi phone number
  • WhatsApp should take down the Booking.com impersonating accounts
  • Remitly should use the provided device information from Table 2 to search for the scammer's account and shut it down 
  • Victims of GreenMwizi style scams should also report them to law enforcement who can begin the process of building a case against GreenMwizi

Popular posts from this blog

Raspberry Robin: A global USB malware campaign providing access to ransomware operators

-
Image
Logo credit: RedCanary Ever since it first appeared in late 2021, the Raspberry Robin malware campaign has been propagating globally. A number of threat intelligence reports by vendors such as RedCanary (who named it) and Microsoft (who track it as DEV-0856/Storm-0856) have covered the malware campaign in great detail.  In fact, the list of blogs I do recommend to read to catch up on this threat are as follows: https://redcanary.com/blog/raspberry-robin https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity https://blog.sekoia.io/raspberry-robins-botnet-second-life/ https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/ https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-sprea...
Read more

Lessons from the iSOON Leaks

-
Image
  Introduction A Chinese Ministry of Public Security (MPS) contractor called  iSOON (also known as Anxun Information) that  specializes in network penetration research and related services has had its data leaked to GitHub. Based on the level of detail, leaked chat logs, amount of data, and corroboration from overlaps indicators of compromise (IOCs), there is a high level of confidence it is legit. Preliminary findings from less than one week since the leak revealed that it contains unprecedented insights into how the Chinese MPS operates by using Chinese commercial surveillance vendors and what their technical capabilities are. The Chinese MPS is China’s internal security service that primarily focuses on  internal and border security, counter-terrorism, surveillance. The MPS is comparable to the  Russian FSB, the US DHS or the UK’s MI5. The most interesting findings have come from iSOON’s product whitepapers and confidential slide deck presentations given to t...
Read more

The Ransomware Tool Matrix

-
Image
Introduction Ransomware attacks are becoming increasingly damaging, but one thing remains consistent: the tools these cybercriminals rely on. The Ransomware Tool Matrix is a comprehensive resource that sheds light on the tactics, techniques, and procedures (TTPs) commonly used by ransomware and extortionist gangs. This repository provides defenders with actionable intelligence on the tools frequently leveraged by adversaries, thanks to the insights shared publicly by the US Cybersecurity and Infrastructure Security Agency (CISA)'s #StopRansomware advisories and The DFIR Report's publications, among others. This repository offers straightforward insights from compiled open source intelligence (OSINT) research that can be directly applied to threat hunting, detection engineering, and incident response operations. Project Background As defenders, we can turn the tables by exploiting a crucial flaw committed by ransomware gangs: tool reuse. Many ransomware gangs repeatedly rely on ...
Read more