Alpha Team Research: Deep Dive Into Rewards Carding

Alpha Team Research: Deep Dive into Rewards Carding

Rewards carding is a popular method of financial fraud. Generally, this kind of fraud tends to go unnoticed by banking customers much more than a drained bank account or suspcious credit card activity would. These rewards points can actually be very valuable, however. They can be used to book hotel rooms and flights, or to purchase expensive retail goods. The sparseness of monitoring and protection, combined with the high potential value, makes this a very appealing target for scammers.

In this post, Alpha Team discusses one particular rewards carding forum, Cardhouse, and how it is used and promoted on the dark web and otherwise.

Recommendations

• Enable multi-factor authentication on your accounts whenever possible
• Actively monitor rewards accounts for suspiscious activity
• Consider enabling dark web rules in order to monitor activity related to your protected entities on the dark web

Details

Cardhouse is a so-called "carding service provider," where a small group of carders offer their services to purchase goods at a discount from retail price. The carders on this site target American Express accounts with high numbers of rewards points. These points are then stolen from the account and used to purchase items of the fradulent purchaser's choosing - usually high-dollar electronics. The site has been advertised via direct message over Discord, seemingly at random. Throwaway accounts are used to send messages with details about the site and services offered.

Once an item is purchased on the site, it is sent to a drop-reshipper. Drop-reshipping is used both to avoid international shipping fees, as well as to provide a level of anonymity to the sender. Generally, the purchaser of the stolen goods will ship the goods to a reshipper, generally a person recruited through a work-from-home scam, and then the object is re-shipped to the buyer of the goods. These re-shippers are generally employed for a very short period of time so that they do not actually have to be paid. The exact re-shipping configuation of the Cardhouse site is unknown, but they claim that their reshipping process "make[s] it impossible for feds to link you to the purchase." Cardhouse will not ship goods to Ghana, Albania, Algeria, or Nigeria. Scammers often avoid doing business within their home countries, to prevent potentially unwanted legal attention, so this could indicate the location of the carders offering their services on this site.

The site charges buyers 30% of the retail price of the desired object, and the site has set a $300 minnimum order so that they are able to cover their costs. Payment is accepted through gift card, debit card, or cryptocurrency. To submit an order, users simply have to submit a form on the site with their desired carder and discord username. All further business is discussed over Discord, a popular game chat platform. In order to bolster their credibility, the scammers have posted "vouches" or reviews from supposedly happy customers. These images show iPhones, expensive gaming chairs, and laptops that purportedly were purchased via Cardhouse. Images include shipping boxes, where a label starting "CARDHOUSE[.]*** ORDER ####" is displayed.

In their FAQ, hosted on pastebin, the group claims to utilize a secret AmEx account carding method, and that users of the service will not go to jail.

Q: Wont I go to jail for this?

A: NO. We are fed up with newcomers quizzing our carders as if they know more about OpSec then we do. 
For one, we use an amex account carding method which is a practically unknown method. Reward point carding 
is very safe as most if not all victims don't call police due to missing reward points, they simply contact 
their bank and get reimbursed assuming they care enough. Even if they did happen to call the police, all 
items we card are shipped to our drop re-shipper and then shipped to you (unless you have your own drop available).

Unfortunately, the scammers aren't necessarily wrong. This type of fraud does tend to go unnoticed - and when affected customers do report it, banks and card companies tend to refund the points without much further investigation. Alpha Team urges readers to follow the recommendations in this post, in order to better protect themselves and their organizations.

Breaking News - 08.05.2019

New Lord Exploit Kit Discovered

A new exploit kit has been discovered by researchers at Virus Bulletin. Dubbed Lord, this is the first exploit kit seen to use ngrok. Ngrok is a service that can be used to expose a local web server to the internet. The kit also checks for vulnerable versions of Adobe Flash Player, before attempting to exploit CVE-2018-15982.

See the full report here: https://www.virusbulletin.com/blog/2019/08/virus-bulletin-researcher-discovers-new-lord-exploit-kit/

New Banking Trojan: Amavaldo

In a deep dive into Latin American banking trojans, researchers at ESET have identified a new malware family named Amavaldo. Written in Delphi, this trojan targets Spanish and Portuguese speaking countries, and seeks to use social engineering to exfiltrate sensitive banking information from infected devices. It is still actively been developed and utilized by attackers.

See the full report here: https://www.welivesecurity.com/2019/08/01/banking-trojans-amavaldo/

No Summer Break for Magecart as Web Skimming Intensifies

Magecart, a notorious cybercrime group, continues their barrage of web-skimming attacks with 65,000 attempts seen in July. In particular, the group is targeting e-commerce sities in order to skim payment information.

See the full report here: https://blog.malwarebytes.com/web-threats/2019/08/no-summer-break-for-magecart-as-web-skimming-intensifies/

Fraudster Stole $870,000 from 2 US Universities

A good win for victims of Business Email Compromise and Spear-Phishing. Amil Hassan Raage co-conspired with fraudsters from Kenya to send fraudulent emails to University of San Diego and managed to get them to 1 million dollars to his Wells Fargo account in Minnesota. When law enforcement caught on, he fled to Kenya where the Kenyan government and the FBI arrested and extradited him back to the US.

See the full report here: https://securityaffairs.co/wordpress/89408/cyber-crime/spear-phishing-frauds.html

Cloudflare Terminates Service to 8chan After Recent US Shootings

8Chan is notorious for hosting discussions for the *chan culture in a more edgy fashion. Recently, they've been associated with hosting manifestos by the perpetrators of the New Zealand, Poway and El Paso mass shootings. Cloudflare has long stood by their non-regulatory stance of sites that they host, but they are taking a much harder stance on extreme websites within the last few years.

See the full report here: https://www.zdnet.com/article/cloudflare-terminates-service-to-8chan-after-recent-us-shootings/

MegaCortex Ransomware Revamps for Mass Distribution

MegaCortex, a ransomware family known for large ransom demands based on a targeted organization's perceived ability to pay, has updated to make it easier for actors to stage attacks at volume. Previously, the ransomware utiilized a unique password for each infection - however updated modules have automated this process so that the malware is able to self-install.

See the full report here: https://threatpost.com/megacortex-ransomware-mass-distribution/146933/

Machete Group Targets Venezuelan Military

An espionage campaign targeting the Venezuelan military has been uncovered. The Machete group, responsible for these attacks, have been utilizing Python tools along with their dropper and malware modules.

See the full report here: https://www.welivesecurity.com/2019/08/05/sharpening-machete-cyberespionage/