Full Report
Group-IB has observed scammers impersonating government officials to trick disaffected consumers into divulging card details
Analysis Summary
# Tool/Technique: Remote Access Tools (RATs) used in Government Impersonation Scam
## Overview
This refers to the use of Remote Access Tools (RATs) by threat actors impersonating government officials to trick victims into installing the software on their mobile devices. The ultimate goal of this multi-stage fraud campaign is card not present (CNP) fraud, achieved after gaining access to the victim's device and coercing them into photographing their credit card.
## Technical Details
- Type: Tool (specifically Remote Access Software)
- Platform: Mobile devices (implied, as victims are persuaded to upload photos from their mobile device)
- Capabilities: Gaining remote control/screen sharing access to the victim's device.
- First Seen: Information suggests the campaign was recently uncovered/reported (January 2025).
## MITRE ATT&CK Mapping
Based on the activity described (gaining remote access via social engineering):
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment (If a link/file related to the RAT download was sent via email/message)
- T1566.002 - Spearphishing Link (If the victim clicked a link to download the RAT)
- **TA0009 - Collection**
- T1119 - Automated Collection (If the tool automatically captures data like card photos)
- **TA0011 - Command and Control**
- T1219 - Remote Access Software (Direct mapping to the use of RATs)
## Functionality
### Core Capabilities
- Establishing remote, shared screen connection to victim's mobile device.
- Facilitating social engineering by establishing a trusted context (impersonating officials).
### Advanced Features
- Used as the final step in a multi-stage attack where initial credentials were stolen via infostealers and sold on the dark web.
- Used to coerce victims into taking photographs of sensitive financial information (credit cards).
## Indicators of Compromise
(Note: The article does not provide specific IoCs for the RAT itself, focusing on the pre-attack vector: compromised government logins.)
- File Hashes: [Not specified in the provided text]
- File Names: [Specific RAT names disguised as part of the 'refund' process, not specified in the text]
- Registry Keys: [Not specified for mobile platform implications]
- Network Indicators: [Implied C2 communication channels required by the RATs, but specific addresses not listed]
- Behavioral Indicators: Installation of remote access applications on victim mobile devices following unsolicited contact from alleged government officials.
## Associated Threat Actors
- Unspecified threat actors purchasing compromised government logins from the dark web to execute targeted social engineering fraud, detailed by Group-IB research.
## Detection Methods
- **Signature-based detection:** Signatures for known RAT payloads (if identifiable).
- **Behavioral detection:** Detecting the installation or execution of remote access applications on endpoints, especially mobile devices, requested during unsolicited calls/interactions.
- **YARA rules:** [Not specified in the provided text]
## Mitigation Strategies
- **Prevention measures:** User training to recognize and refuse unsolicited requests for installing software or sharing screen access, particularly when linked to official business or refunds. Never trust unsolicited contact referencing private data.
- **Hardening recommendations:** Strict controls on installing unverified applications on mobile devices. Security protocols within government portals to prevent the exposure of user complaints/contact information to external parties.
## Related Tools/Techniques
- **Infostealers:** Used in the preliminary stage to acquire government account logins.
- **Social Engineering/Impersonation:** The primary method used to trick victims into installing the RAT.
- **Card not present (CNP) Fraud:** The ultimate objective of the campaign.