Hello world, in today's exploration of cyber security tech news: Trying to phish the US
Department of Defence out of $20 million dollars takes either balls of steel or brains of mush,
and unfortunately for one cyber criminal, he was more of the mushy brain type, and is now facing
potentially 30 years in prison for his operation. His name? "Sercan Oyuntur" - probably butchered
that one. But anyway, this guy previously ran mobile phone repair shops in California,
but they didn't really work out for him, with one closing barely 2 months after opening. So shortly
after, he hatched a money making plan to target the US government's sam.gov website - standing for
"System for award management" - this website is used by companies to bid for government contracts.
So when the US government wants to buy something, like - oh I don't know,
cruise missiles - they post it on this site where different companies can bid for the contract.
You can find all sorts of things on here, even contracts for Sausages destined for prison food.
"Sercan"'s plan was kinda straight forward, just download the login page for the website and host
a clone of it on his own domain, that he could use to grab login credentials from unwitting
visitors - then send spear-phishing emails from a domain disguised to look like the genuine domain
used to contact military contractors. He targeted government contractors who had been
awarded contracts, but had not yet been paid, encouraging them to log in using his fake page
to grab their creds, which he would use to log in as them on the real site - and change their bank
details to his own, redirecting payments from the US military to himself. It's a risky move,
I mean, stealing money from the one military with the ability to drone strike anywhere on earth is
ambitious, especially if it's your first foray into cyber crime. And you'll probably realise
he did eventually get caught by the fact I'll be referencing court documents throughout this video,
but more on his awful opsec later. As for how he managed to gather email addresses of contractors
for his phishing campaign - the court documents just don't explain that, but if I was him I
would've taken advantage of the fact that for transparency reasons the "sam.gov" website lists
all the companies that have been awarded contracts and what contracts they have been awarded,
so it would be fairly straightforward to scrape those and gather email addresses.
Eventually, a contractor did somehow fall victim to his phishing campaign,
a South Korean oil refinery, which is actually kept anonymous in the court documents and only
referred to as "corporation 1", but the court documents do show the victim's email address,
and if you just google it, you'll find it appears to belong to a company called
S-Oil. And, I find it kinda funny that this company - which is owned by Saudi Aramco,
literally the world's most valuable company - is using a basic gmail address,
also, the court documents say that the victim operating this email is the only
US based representative for the company - and upon further digging he's operating out of a
condo in New Jersey, this kinda makes me think that perhaps S-Oil was just paying one of those
virtual assistants to handle their US admin work, a decision I imagine they regret if that's true.
But anyway, after grabbing the login creds - "Sercan" realised that the victim's account
had 2FA enabled, so he had to send yet another phishing email which convinced
the victim to hand over their 2FA recovery code. After that, he went ahead and logged
into the real SAM.gov website as the victim, and in attempt to cover his tracks, he used NordVPN.
Which might seem a bit basic and low effort, but the court documents do explain that after
the FBI traced his IP to the internet backbone service provider "Cogent",
then to the ISP "M247", and eventually to NordVPN - they didn't even bother contacting Nord and
just noted that since "NordVPN is located in Panama", they do "not comply with US subpoenas
or warrants" - so I guess that was a dead end for investigators. However it is important to
note that since this investigation NordVPN has quietly updated their stance on court orders
saying they will now apparently comply with them, interestingly they also add that
"we never log [user] activity unless ordered by a court in an appropriate, legal way." - implying
logging is not necessarily off the table, despite saying they're "100% committed to zero-logs",
confusing at best - but at the end of the day I suppose this stuff is all up to lawyers. And if
you try to dig into NordVPN's changing stance on law enforcement compliance you'll find it seems
they've excluded their entire domain from the wayback machine... but anyway, enough of NordVPN.
After logging in to the victim's account, our miscreant found the oil refinery had been awarded
a contract to supply the US military with 10 million gallons of "Aviation JA1 Turbine fuel"
otherwise known as "Jet Fuel" - the contract was worth over $23 million dollars. And after
changing the oil refinery's bank details, all 23,453,350.90 coins landed in the bank account
of his friend's used car dealership - and, yes, this was the plan, to launder the funds through
his friend's used car dealership "Deal Automotive Sales". However unfortunately for our miscreant
he wasn't aware that cookies are a thing. As he logged into the fraudulent bank account using
the same device and browser as his personal bank account, which meant the exact same cookie ID was
logged by "Bank Of America" for both sessions, making attribution real easy for the FBI,
as it would be rather difficult to explain that one away in court, and I suppose it
was - because whilst our miscreant was trying to withdraw the cash, the South Korean oil refinery
noticed that their $23 million dollars was missing, launching an investigation - which
eventually led to "Sercan" being found guilty and he's now facing potentially 30 years in prison.
I suppose there's lessons to be learned on all sides here, don't hire a virtual assistant to
handle tens of millions of dollars - assuming that's what S-oil was doing. And don't try to
scam the US government, it's just not going to end well, especially if the plan is to
launder cash through a used car dealership registered in the name of your friend.
This video was made possible by Linode, who are giving you a $100
60-day credit just for signing up. Linode is essentially your
swiss army knife for cloud computing, if it runs on linux it'll run on Linode.
One great feature of Linode is their app marketplace
which makes it super easy to spin up servers with preconfigured software.
For example, use Linode's pi-hole app to set up a DNS sinkhole, that you can use to block
ads across all your devices - and yes I recognise the irony in promoting ad blocking within an ad!
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices. Use the link in the description now to claim your free $100.
As always, thanks for watching, and you know what to do, tickle that notification
bell and follow me on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.