Hunting Mammoths using Telegram bot

We devised the name Telekopye as a portmanteau of Telegram and kopye (копье), the Russian word for spear, due to the use of highly targeted (aka spear-) phishing. Victims of this scam operation are called Mammoths by the scammers (see Figure 1) and several leads point to Russia as the country of origin of the toolkit’s authors and users. For the sake of clarity, and following the same logic, we will refer to the scammers using Telekopye as Neanderthals.

Thanks to human nature, scamming in online marketplaces seems to be very easy. It usually comes down to several key parts of the scam, as seen in Figure 2, that Neanderthals follow. First, Neanderthals find their victims (Mammoths). Then they try to earn their trust and persuade them that they are legitimate (why this is needed we will discuss in part 2). When Neanderthals think that a Mammoth sufficiently trusts them, they use Telekopye to create a phishing web page from a premade template and send the URL to the Mammoth (the URL can also be sent via SMS or email). After the mammoth submits card details via this page, the Neanderthals use these card details to steal money from the Mammoth’s credit/debit card, while hiding the money using several different techniques such as laundering it through cryptocurrency. Based on several conversation snippets, we assess that some crypto mixers are involved. There is a missing link between when money is scammed from the Mammoth and the payout to the Neanderthals, which is usually in cryptocurrency.

Telekopye has several different functionalities that Neanderthals can use to their full extent. These functionalities include sending phishing emails, generating phishing web pages, sending SMS messages, creating QR codes, and creating phishing screenshots. In the following sections, we will focus on the most useful parts of Telekopye for the average Neanderthal.

Every Telegram group using Telekopye consists of one or more Neanderthals that operate simultaneously and independently. Functionality is offered through buttons, likely to make scamming easier for Neanderthals.

Figure 3 shows one of the menus of Telekopye in a working Telegram group. Particularly noteworthy are the buttons “My ads”, showing all opened listings (ongoing scam advertisements) each Neanderthal has, and “My profile”, allowing Neanderthals to see their profile information on this platform, such as the number of scams pulled off, amount of money ready for next payout, etc.

The core feature of Telekopye is that it creates phishing web pages from predefined HTML templates on demand. A Neanderthal needs to specify the amount of money, product name and, based on the template, additional information like location to which the product will be sent, picture, weight, and buyer’s name. Then Telekopye takes all this information and creates a phishing web page. These phishing web pages are designed to mimic different payment/bank login sites, credit/debit card payment gateways, or simply payment pages of different websites.

To make the phishing website creation process easier, these website templates are organized by countries they target. Figure 4 shows a simple creation menu where some templates are sorted according to different countries. The only outlier is BlaBlaCar for country-independent car-sharing services.

Figure 5 shows one such phishing web page, likely not fully perfected yet.

The finished product is seen in Figure 6, an eBay web page look-alike that is almost unrecognizable from the original (or at least looks like something one would expect from the legitimate website).  By clicking the Receive %amount2% EUR button, a Mammoth is shown a fake credit/debit card gateway.

These phishing domains are not easy to spot. Usually, Neanderthals register a domain and then create subdomains for each targeted marketplace in such a way that the final URL starts with the expected brand name. In Table 1 notice that only one domain – olx.id7423[.]ru – is used to target the popular marketplace OLX. An example of a legitimate domain for the OLX marketplace is olx.ua. In short, they usually use .ru as their top-level domains and move second-level domains to the third-level domain’s place.

Table 1. Examples of several domains used for phishing

Neanderthals do not transfer money stolen from Mammoths to their own accounts. Instead, all the Neanderthals use a shared Telekopye account controlled by the Telekopye administrator. Telekopye keeps track of how successful each Neanderthal is by logging associated contributions to that shared account – either in a simple text file or a SQL database.

As a consequence, Neanderthals get paid by the Telekopye administrator. Payment is split into three parts:

1.    Commission to the Telekopye administrator.

2.    Commission to recommender (recommendation system is discussed later in the blog post).

3.    Actual payout.

The commission to the Telekopye administrator is 5–40%, depending on the Telekopye version and Neanderthal role (roles are also discussed later in the blog post).

Once a Neanderthal becomes eligible for a payout, he asks Telekopye for one. Telekopye checks the Neanderthal’s balance, final request is approved by the Telekopye administrator and, finally, funds are transferred to the Neanderthal’s cryptocurrency wallet. In some Telekopye implementations, the first step, asking for a payout, is automated and the negotiation is initiated whenever a Neanderthal reaches a certain threshold of stolen money from successfully pulled off scams (e.g., 500 RUB). The process of the manual payout request is illustrated in Figure 7 and the associated part of the Telekopye source code in Figure 8.

Telekopye keeps logs of processed payouts in a separate Telegram channel. A Neanderthal who is paid also receives a link to this channel, probably to be able to verify that the transaction is logged. Figure 9 shows an example of such a logs channel.

The Telekopye administrator does not transfer the money through Telekopye itself. Instead, the admin uses either a tool called “BTC Exchange bot”, likely an independent Telegram bot, or transfers the money manually. However, we have observed increasing integration of payout-related features into Telekopye, so this may change in the future.

Neanderthals can instruct Telekopye to create and send email messages. The sender is a predefined email account shared between all the Neanderthals. These email accounts are typically associated with the phishing domains set up by Neanderthals. Figure 10 shows the code to spoof the email headers From and Reply-To so that the email messages appear more legitimate.

Figure 11 shows one of many templates used to create phishing email bodies. No additional information has been given, so default values are shown, instead of user-defined text, for %title% and %amount%. A malicious URL is hidden behind the “Go to payment” button.

Besides phishing emails, Telekopye allows Neanderthals to create and send SMS messages in a similar manner. Figure 12 illustrates the piece of code responsible for creating and sending such messages.

Some implementations of Telekopye even have predefined SMS texts in different languages. All SMS templates say more or less the same thing, for example, “Your item has been paid for. To receive funds, fill out the form: ”. Examples of several SMS templates are shown in Figure 13, where original Russian templates are shown.How this SMS looks when a Mammoth receives it can be seen in Figure 14.

Telekopye relies heavily on online services such as smscab.ru or smshub.org to send SMS messages. We have analyzed an older variant, where Telekopye used one hardcoded phone number shared among all Neanderthals. However, likely because blocking one phone number would result in blocking all Neanderthals’ messages, this feature was discontinued.

In this section, we describe how simple it is for Neanderthals using Telekopye to create convincing images and screenshots. Some versions of Telekopye have a component called Render bot. Although Render bot could be classified as a standalone bot, we will handle it as part of Telekopye.

When Render bot is added to a Telegram chat, we are greeted with the initial message seen in Figure 15.

This gives us good insight into how this part of Telekopye works. We can classify the uses of Render bot into two categories. First, it can be used to mangle images so that they are not easy to cross-reference. Second, it can create fake images that are meant to look like legitimate screenshots. In this section, we will focus first on the creation of these fake screenshots, a feature similar to creating phishing websites.

Unlike fake web pages that are generated from HTML templates, the base for fake screenshots is a JPG image with some key parts removed. These parts include the supposed paid price, debit/credit card number, title, name, etc. This transformation is shown in Figure 16, where there is a side-by-side comparison of a plain template and a filled template. Because these are images, there are no interactive buttons, unlike the email and phishing web page counterparts.

There is a high emphasis on making the inserted text fit as well as possible, so Telekopye supports several different fonts. Just as previously, all behavior is hardcoded and no AI is used. We found nine templates for Sberbank, Avito, Youla, Qiwi, and a few other services.

From the Neanderthals’ perspective, creating these screenshots is no different from creating phishing web pages. A Neanderthal only needs to supply a few bits of information, and Telekopye creates a fake screenshot/image from them.

In Render bot folders it is also possible to see one of these templates in the process of creation. Figure 17 shows a photo of an invoice for a parcel, with numbered fields. Developers of Telekopye erase all fields with numbers next to them and try to fit their own font style and font size in them. When they are satisfied with how the final product looks, they add it to the bot for other Neanderthals to use as a new template.

Another no less important functionality of this part of Telekopye is image manipulation. From the code and its comments, it is possible to gather that it is able to change images of advertised goods so that search engines cannot cross-reference them. We assume that if the image was found on an online marketplace, AI antispam protection would flag it as malicious. This transformation is very simple and consists of a vertical flip of the image and a small change in contrast.

Thanks to content from Telekopye source files, we assess that the developers are trying to experiment with different types/variations of the scam. For example, in the code, we see QR code generation functionality (Figure 18). This might mean one of two things. Either it is part of the payout process or they are trying to make it a new trick for scamming. A probable reason is that Mammoths don’t think twice when paying via a QR code. So we estimate that there is going to be a small increase in scams using these kinds of tricks.

From Figure 15 it looks as if Render bot can create fake checks for Sberbank. But in reality, it can only create payment confirmations (Figure 19).

Groups of scammers using Telekopye are organized into a hierarchy with least to most privileges in order as follows:

1.    Administrators

2.    Moderators

3.    Good workers / Support bots

4.    Workers

5.    Blocked

We have observed some variants enriching this list with a few additions, but these five roles remain the basis. We focus on each role in more detail in the sections below.

Telekopye also employs a referral system. When a new Neanderthal wants to join the group, he needs to fill in an application (how much “industry” experience he has, who invited him, etc.). This application then needs to be accepted by Moderators or Administrators in order for the new Neanderthal to join.

A user with this role is not able to use any part of the Telekopye toolkit. Rules that are part of Telekopye source code suggest this is some sort of punishment for breaking them (Figure 20).

This is the most common role that almost all new Neanderthals start with. With this role, Neanderthals are able to use every Telekopye feature, excluding moderation of the group. During payout, this role has the worst commission rates, as seen in Table 2.

This role is a direct upgrade of the Worker role. The only difference is that Neanderthals with this role don’t have to give such a large percentage of their payout to the platform owner.

To get this role, Neanderthals must prove their usefulness – pull off a number of scams or achieve a certain amount of stolen funds.

Sometimes it is possible to see that this role is reserved for support bots. We are not certain what these bots are.

Administrators are the highest role in the group. They can use Telekopye to its full extent. On top of moderators’ capabilities, they can modify Telekopye settings – add phishing web page templates, change/add email addresses that the bot uses, and change payout rates, payout type, etc.

The easiest way to tell whether you are being targeted by a Neanderthal trying to steal your money is by looking at the language used. It can be the language used in conversation, email, or on the web page itself. Sadly, this is not foolproof, and it has been observed that some of these scam attempts have ironed out grammar and vocabulary mistakes.

Insist on in-person money and goods exchange whenever possible when dealing with secondhand goods on online marketplaces. Such trades are not protected by well-known institutions or services. These scams are only possible because Neanderthals pretend they already paid online/sent an item. Sadly, sometimes in-person delivery is not possible and in that case you need to be extra careful.

Avoid sending money unless you are certain where it will go. When you need to send money somewhere, check the web page for grammatical errors and graphical disproportions. If you are lucky, a template can have some inaccuracies. Also check the website certificate and look closely at the URL, which can be made to look like a real link.

Watch out for strong-arm arguments like “I’ll send money through service XYZ. Do you know how it works?”. Ask if another payment type is possible and especially if they are willing to accept payment from a service you are familiar with. This is not foolproof because scammers have multiple templates, but you might be able to recognize a fake template more easily when you use a payment method known to you.

Be extra careful when clicking on links in SMS messages or emails, even if they look as if they come from a reputable source. Neanderthals are no strangers to email spoofing. A good rule of thumb is to ask yourself whether you bought something that would make reputable sources send you emails like that. If you are unsure, visit the supposed service’s website directly (not using the link in the email/SMS) and ask. Most of these pages have customer support and they will happily give you a hand.

We discovered and analyzed Telekopye, a toolkit that helps less technical people pull off online scams more easily. We estimate that Telekopye was in use since at least 2015. We focused on one version, analyzing its main capabilities and uncovering how Telekopye works internally. These capabilities include creating phishing websites, sending phishing SMS and emails, and creating fake screenshots. We also described the hierarchy of groups using Telekopye. Thanks to our telemetry, we also found out that this tool is still in use and in active development. The second Telekopye blog post, which will be released later, uncovers the inner working of the scam groups.

Acknowledgement

The author would like to thank Ondřej Novotný for the initial discovery.