Full Report
This blog details online investment scam campaigns, including fraudulent cryptocurrency, forex, and trading platforms, while offering a technical investigation guide for investigators, based on Group-IB’s technical investigation methodology. It outlines the social engineering tactics and victim manipulation models employed, describes the fraud actor structures behind these schemes, and highlights key infrastructure artifacts identified by Group-IB High-Tech Investigations analysts that can be leveraged by cybersecurity professionals for detection and disruption.
Analysis Summary
# Tool/Technique: Investment Scam Infrastructure & Victim Manipulation Flow
## Overview
This technical investigation outlines the systematic infrastructure and social engineering frameworks used in global online investment scams (cryptocurrency, forex, and fraudulent trading). The technique relies on a "Multi-Actor Fraud Network" model where specialized groups manage infrastructure, victim acquisition, and payment laundering through shared technical artifacts and psychological manipulation.
## Technical Details
- **Type**: Fraud Framework / Social Engineering Technique
- **Platform**: Web (HTML/JS), Mobile (Android/iOS via sideloading/web-apps), Messaging Apps (Telegram, WhatsApp)
- **Capabilities**: Victim screening, automated chat simulation, fake trading dashboards, and laundering via "Mule" account networks.
- **First Seen**: Ongoing; significantly evolved with standardized frameworks like **Layui** and **ThinkPHP**.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.003 - Phishing: Spearphishing via Service (Social Media/Messaging)]
- **[TA0007 - Discovery]**
- [T1204.001 - User Execution: Malicious Link]
- **[TA0011 - Command and Control]**
- [T1102.002 - Web Service: Bidirectional Communication (Chatbots/Telegram APIs)]
- **[TA0010 - Exfiltration]**
- [T1567 - Exfiltration Over Web Service (Financial data/PII)]
## Functionality
### Core Capabilities
- **Victim Manipulation Flow**: A step-by-step psychological model used to screen "high-value" targets, build trust via fake profit screenshots, and extract initial deposits.
- **Fraudulent Trading Dashboards**: Real-time manipulation of graphs and balances to show fake gains, encouraging larger investments.
- **Automated Chat Simulators**: Scripted bots used to deliver payment instructions and maintain contact with thousands of victims simultaneously.
### Advanced Features
- **Shared API Infrastructure**: Multiple scam domains often call the same backend APIs for user management and payment processing.
- **Admin Panel Standardisation**: Usage of Chinese-language administrative backends (e.g., based on **ThinkPHP**) to manage thousands of "promoters" and "closers."
- **Fingerprinting Evasion**: Dynamic generation of subdomains and frequent rotation of SSL certificates to bypass static blocklists.
## Indicators of Compromise
- **File Names**: `app.apk`, `trading_platform.ipa` (typically delivered via social engineering rather than official stores).
- **Network Indicators (Defanged)**:
- Shared SSL Common Names (CNs) across multiple domains.
- Reused API endpoints: `api[.]scam-cloud[.]com`
- Fraudulent domains often follow naming patterns: `[brand]-invest[.]vip`, `[brand]-trade[.]cc`.
- **Behavioral Indicators**:
- Use of the **Layui** front-end framework in unusual financial contexts.
- Frequent API calls to Telegram Bot tokens for exfiltrating victim data.
## Associated Threat Actors
- **Multi-Actor Fraud Networks**: Large-scale syndicates operating primarily out of Southeast Asia (Vietnam, Cambodia, Laos).
- **Masterminds**: Core infrastructure providers who lease the scam platforms.
- **Promoters/Closers**: Social engineering specialists who interact directly with victims.
## Detection Methods
- **Signature-based detection**: Tracking specific CSS/JS fingerprints of the **Layui** framework or specific "ThinkPHP" admin login page artifacts.
- **Behavioral detection**: Monitoring for anomalous payment flows and flagging known "mule" account patterns.
- **Infrastructure Mapping**: Identifying reused SSL certificates and shared IP addresses hosting multiple unrelated "trading" platforms.
## Mitigation Strategies
- **Prevention measures**: Deployment of Digital Risk Protection (DRP) to proactively take down domains impersonating legitimate brands.
- **Hardening recommendations**: Implement real-time monitoring of payment flows to detect and block funds destined for known fraud-related "mule" accounts.
- **User Education**: Training users to recognize the "Victim Manipulation Flow" (e.g., unsolicited "investment opportunities" via Telegram/WhatsApp).
## Related Tools/Techniques
- **Pig Butchering (Sha Zhu Pan)**: The overarching social engineering methodology.
- **Mule-as-a-Service (MaaS)**: Third-party services providing the bank accounts used to receive and wash scam proceeds.
- **Deepfake/AI Audio**: Emerging techniques used to bypass KYC (Know Your Customer) checks and enhance social engineering.