Intelonyx

Very much looking forward to presenting again at the @MachinaRecord annual #CyberIntelligence Summit in #Tokyo. I’ll discuss my DIME model for building #intelligence operations with a focus on infostealer logs, and why this source of signal rich data is critical to mitigate risk.

‼️As the prevalence of #pigbutchering scams increases, it's crucial to remember that anyone can be a target, regardless of their awareness or expertise. 👉🏽Recently, I encountered a concerning pattern: within a single day, I received five friend requests on one of my private social media accounts. These requests came from accounts with similar characteristics, all portraying individuals who appear to be avid travelers, sharing images of luxurious destinations and events. What caught my attention was that these accounts all featured images of the same person, suggesting a coordinated effort to deceive. 🚩Here are some red flags I noticed: 1️⃣All accounts were created within a 24 hour period in November 2023. 2️⃣The account names follow similar themes related to travel and exploration. 3️⃣Each account claims to reside in the same metropolis where I lived in the past. 4️⃣Friend requests were sent within a 24-hour period. 5️⃣Bios consist of generic one-liners about living life. 6️⃣Similar posting frequencies across all accounts. 7️⃣Comparable numbers of followers and accounts being followed across all accounts. 8️⃣All accounts have images of the same person in various “luxury” environments: sandy beaches, hotels, big cities. This appears to be an orchestrated approach and it signals a potential pig-butchering scam 👇🏼🧵 - In this case, the individual would try to engage me in a conversation about a topic of interest, likely the city where I live or lived, global travel and fancy destinations, about my work and other topics. - The individual would then try to get closer with moving the conversation to a more private and encrypted medium, such as #WhatsApp, #Signal or #Telegram. - They would then try to get even closer with intimate conversations about family and loved ones. - They would potentially share explicit images of themselves or ones that show their interest in me beyond friendship. - They would try to manipulate me by sharing their feelings about me, how much they like me and even longing to meet me in person. - They would share stories about the suffering they endured or the grief of losing someone, in order to establish the hook of emotional #manipulation. - Several weeks or even months later, they would discuss their amazing work in #crypto investments and share screenshots of their earnings. - They would tell me about this incredible opportunity where I would need to invest just a bit for big earnings. - Once they have that hook established, they would have me transfer money to what appears to be a legitimate #crypto investment interface and I would be psyched about my earnings. - Once they fattened me enough, it would be time to disengage and drain the money I’d invested because in reality I would have been transferring money not to a crypto exchange but to their #cryptowallets. #Beware, folks. Read the @intelonyx blogpost on #pigbutchering to learn more intelonyx.com/blog/f/digital…

Of course, this designation is unique in that it targets a pro ISIS cyber advisory group. But it is also expected given the group’s crypto fundraising and money remittance support — placing the individuals behind it in the crosshairs of countering terrorism financing (CTF) efforts.

For the longest time, Horizons regularly posted advisory on everything from using encrypted communications platforms (Telegram, Threema and others) to warning about using smart phones to using Signal instead of WhatsApp, to using VOIP and “virtual phone numbers” to create social media accounts.