Threat video1:00
Europol Investment Scam Takedown: Detection & IOCs
Europol and Eurojust seized 100+ servers behind fake investment platforms. Includes 9 detection rules (one free in Splunk SPL) and 8 IOCs.
Read the full threat intel for Europol Investment Scam Takedown: Detection & IOCs →
Chapters
- 0:00The hookOver 100 servers seized.
- 0:04The storyInvestigation began in 2022 from lost deposits.
- 0:12Attack pathCrime-as-a-service infrastructure: platforms, adverts, hosted in Cyprus and Israel.
- 0:31AttributionNo threat actor is attributed.
- 0:35Indicators of compromise1 indicator to hunt: 1 hosting.
- 0:40MITRE ATT&CK techniques6 ATT&CK techniques, from reconnaissance to impact.
- 0:44Remediation3 steps now: Warn customers and staff about unsolicited investment offers promising quick.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Over 100 servers seized. Seven arrested in takedown.
0:05Investigation began in 2022 from lost deposits.
0:09Four years later: today's dismantling.
0:13Crime-as-a-service infrastructure: platforms, adverts, hosted in Cyprus and Israel.
0:18Deceptive ads and calls brought victims to fake platforms.
0:22Deposits became demands for larger transfers with fabricated profits.
0:27Withdrawals blocked. Contact ended.
0:31No threat actor is attributed. Confidence: low.
0:351 indicator to hunt: 1 hosting.
0:406 ATT&CK techniques, from reconnaissance to impact.
0:443 steps now: Warn customers and staff about unsolicited investment offers promising quick.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.