Threat video1:00
Wuffy 250+ Fake Storefront Scam Network: Detection & IOCs
Mastercard linked roughly $50M to 250+ Wuffy storefronts selling a plush toy as an AI dog. Includes 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Wuffy 250+ Fake Storefront Scam Network: Detection & IOCs →
Chapters
- 0:00The hook250 fake storefronts sold no-AI toys.
- 0:04The storyVictims reported fake reviews.
- 0:10Attack pathAccording to reports, fake ratings deceived buyers.
- 0:26AttributionNo threat actor is attributed.
- 0:30Indicators of compromise4 indicators to hunt: 4 domains.
- 0:35MITRE ATT&CK techniques6 ATT&CK techniques, from resource development to impact.
- 0:40Remediation3 steps now: Block or flag getwuffy[.]com, wuffy[.]nl and gowuffy[.]checkoutera[.]com at web/DNS filtering.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00250 fake storefronts sold no-AI toys.
0:05Victims reported fake reviews.
0:07Proceeds through shell companies.
0:11According to reports, fake ratings deceived buyers.
0:14Low-value card transactions exploited chargeback losses.
0:18Returns required shipping to China.
0:21Proceeds routed through Lithuanian shells.
0:26No threat actor is attributed. Confidence: low.
0:304 indicators to hunt: 4 domains.
0:366 ATT&CK techniques, from resource development to impact.
0:403 steps now: Block or flag getwuffy[.]com, wuffy[.]nl and gowuffy[.]checkoutera[.]com at web/DNS filtering.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.