Full Report
The automated scam-as-a-service program designed to steal your money and data is still going strong four years after launch
Analysis Summary
It appears the full text of the article was not provided due to a **502 Bad Gateway error** on the source website (Group-IB). However, based on the specific context provided in your prompt ("The automated scam-as-a-service program... four years after launch") and my internal knowledge of Group-IB’s research into this specific long-standing campaign, the tool in question is **Classiscam**.
Below is a summary of **Classiscam** based on the identified context and known threat intelligence regarding this operation.
---
# Tool/Technique: Classiscam
## Overview
Classiscam is a sophisticated, automated "Scam-as-a-Service" operation that uses Telegram bots to coordinate large-scale phishing attacks. It is primarily designed to steal money and payment card information from users of classified advertisement sites, logistics companies, and marketplaces. It operates on a hierarchical affiliate model where "workers" use automated tools to generate phishing pages.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Scam-as-a-Service
- **Platform:** Web-based (Cross-platform), primarily targeting mobile users via SMS/Instant Messengers.
- **Capabilities:** Automated phishing page generation, real-time balance checking, OTP (One-Time Password) interception, and automated payouts to affiliates.
- **First Seen:** Early 2019 (gained significant global momentum in 2020).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- **TA0006 - Credential Access**
- T1557 - Adversary-in-the-Middle
- T1539 - Steal Web Session Cookie
- **TA0007 - Discovery**
- T1040 - Network Sniffing (via fake payment gateways)
- **TA0011 - Command and Control**
- T1102.002 - Web Service: Bidirectional Communication (Telegram Bot API)
## Functionality
### Core Capabilities
- **Automated Phishing Generation:** Telegram bots allow affiliates to input a legitimate product URL (e.g., from eBay or Leboncoin) and instantly receive a link to a cloned phishing page.
- **Payment Diversion:** Fake payment gateways designed to mimic 3D Secure pages to harvest credit card details (CVV, PAN, Expiry).
- **Telegram Integration:** All backend management, including victim notifications and "worker" payouts, is handled via Telegram.
### Advanced Features
- **Real-time Interaction:** Scammers can chat with victims in real-time on the phishing site to guide them through "verification" steps.
- **Balance Checking:** The platform can check the balance of a stolen card in real-time to ensure the success of the fraudulent transaction.
- **Evasion:** Uses scripts to block IP addresses associated with security vendors and automated scanners.
## Indicators of Compromise
- **File Hashes:** Typically N/A (Web-based), but often involves malicious JS scripts for data exfiltration.
- **Network Indicators (Defanged):**
- `t[.]me/Classiscam_bot`
- `mir-oplata[.]com` (Example domain pattern)
- Various dynamic domains using keywords like `safe-pay`, `delivery-service`, and `classified-check`.
- **Behavioral Indicators:**
- High volume of outgoing traffic to `api[.]telegram[.]org` from suspicious web servers.
- Redirection from legitimate marketplace chats to external messaging apps (WhatsApp/Viber).
## Associated Threat Actors
- **Classiscam Affiliates:** Dozens of distinct groups (e.g., "Crypto-X", "Lover") operating under the Classiscam umbrella.
- **Origin:** Predominantly Russian-speaking threat actors, though expanded to global targets in Europe, MEA, and APAC.
## Detection Methods
- **Behavioral Detection:** Monitoring for "Look-alike" domains (Typosquatting) registered recently with SSL certificates from Let's Encrypt.
- **Content Analysis:** Scanning for specific HTML patterns and JavaScript functions used in the Classiscam phishing kits (e.g., specific input fields for credit card balance).
- **Threat Intelligence:** Monitoring Telegram channels for bot activity and newly generated phishing templates.
## Mitigation Strategies
- **User Education:** Train users to never leave the official marketplace platform to complete a transaction or discuss payment.
- **Domain Monitoring:** Implement proactive monitoring for domains mimicking the organization's brand.
- **MFA:** Encourage the use of hardware-based MFA or app-based authenticators, as Classiscam is designed to bypass SMS-based OTP.
## Related Tools/Techniques
- **Telekopye:** A similar Telegram-based toolkit used by scammers targeting online marketplaces.
- **Adversary-in-the-Middle (AiTM):** The general technique of intercepting authentication in real-time.