Cybersecurity News in Asia

RECENT STORIES:

SEGA moves faster with flow-based network monitoring
Scam encounters remained widespread in 2024/25: prevention efforts cha...
GOVWARE 2025: SECURING THE NEXT CHAPTER OF DIGITAL TRUST, INNOVATION, ...
Cohesity Named a Leader Once Again in the IDC MarketScape: Worldwide C...
From Enhanced Tax Stamps to AI Enabled Illicit Trade Intelligence syst...
/C O R R E C T I O N — Pismo/
LOGIN REGISTER
CybersecAsia
  • Features
    • Featured

      Psst… know anyone interested in selling his/her identity?

      Psst… know anyone interested in selling his/her identity?

      Tuesday, October 7, 2025, 10:30 AM Asia/Singapore | Features
    • Featured

      When failure is not an option

      When failure is not an option

      Monday, October 6, 2025, 3:02 PM Asia/Singapore | Features, Newsletter
    • Featured

      Fragmented data, fractured trust

      Fragmented data, fractured trust

      Tuesday, September 30, 2025, 3:09 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning

Select Page

News

How two threat groups have been orchestrating large-scale scams

By CybersecAsia editors | Monday, May 5, 2025, 10:18 AM Asia/Singapore

How two threat groups have been orchestrating large-scale scams

Threat research has delved into their modus operandi involving two pathways: evasive social media investment scams and news spoofing and falsification.

On 29 April 2025, a network cybersecurity firm announced the identification of two cybercriminal groups that have been orchestrating large-scale scams using registered domain generation algorithms (RDGAs).

These groups employ automated techniques to create and register vast numbers of domains, leveraging well-known names and brands to make their campaigns appear credible and trustworthy.

By algorithmically generating and registering large volumes of domains, these two threat groups can complicate detection and blocking efforts. The domains are used for scams, phishing, malware, and spam, necessitating advanced security measures to defend against evolving threats.

Threat group profiles

The first group has been identified as operators of social media investment scams:

  • Facebook ads are used to promote fraudulent investment platforms. Campaigns often feature fake celebrity endorsements and thousands of domains to evade detection.
  • The malicious domains are configured so that any subdomain query returns a response, creating noise in DNS and making it difficult to identify which subdomains are actively used for scams.
  • This threat group targets victims in Australia, New Zealand, and Taiwan, using localized content to increase the plausibility of their scams.
  • The success of these investment scams often relies on creating a sense of urgency and sense of missing out.

The second group has been identified as operators of cloaking and spoofing services:

  • Employing own cloaking service to perform validation checks on users, this threat group primarily target victims in Eastern Europe, impersonating real local news websites or prominent brands.
  • Real news websites or major brands are spoofed by the group websites, such as Russian news sites or messaging platforms, to lure victims.
  • This group uses constantly changing URL paths for scam landing pages, making them more difficult to trace.

According to Infoblox, the firm that disclosed its threat intelligence to the authorities, because the two groups of criminals use DNS exploitation for their campaigns, defenders can use DNS as a key element for security. Automated detection and correlation of scam domains at scale are important for effective defense. Preventing access to fake media and platforms using protective DNS services with robust threat intelligence can also help.

Share:

PreviousWith Q1 2025 over, research teams fine-tune their cyber predictions for the rest of the year
NextNew disinformation trend: Widespread fabrication or recycling of victim claims by ransomware groups  

Related Posts

Found and fixed: vulnerability in remote-working gateway Apache Guacamole

Found and fixed: vulnerability in remote-working gateway Apache Guacamole

Tuesday, July 14, 2020

Managing and protecting data in a world of tracing apps

Managing and protecting data in a world of tracing apps

Friday, June 11, 2021

White vs Black — pitting opposing hacker camps for better cybersecurity

White vs Black — pitting opposing hacker camps for better cybersecurity

Tuesday, June 16, 2020

5 easy tips to become super safe online

5 easy tips to become super safe online

Wednesday, March 18, 2020

Leave a reply Cancel reply

You must be logged in to post a comment.

Voters-draw/RCA-Sponsors

Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
previous arrow
next arrow

CybersecAsia Voting Placement

Gamification listing or Participate Now

PARTICIPATE NOW

Vote Now -Placement(Google Ads)

Top-Sidebar-banner

Whitepapers

  • 2024 Insider Threat Report: Trends, Challenges, and Solutions

    2024 Insider Threat Report: Trends, Challenges, and Solutions

    Insider threats continue to be a major cybersecurity risk in 2024. Explore more insights on …Download Whitepaper
  • AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    The future of cybersecurity is a perfect storm: AI-driven attacks, cloud expansion, and the convergence …Download Whitepaper
  • Data Management in the Age of Cloud and AI

    Data Management in the Age of Cloud and AI

    In today’s Asia Pacific business environment, organizations are leaning on hybrid multi-cloud infrastructures and advanced …Download Whitepaper
  • Mitigating Ransomware Risks with GRC Automation

    Mitigating Ransomware Risks with GRC Automation

    In today’s landscape, ransomware attacks pose significant threats to organizations of all sizes, with increasing …Download Whitepaper

Middle-sidebar-banner

Case Studies

  • HOSTWAY gains 73% operational efficiency for private cloud operations  

    HOSTWAY gains 73% operational efficiency for private cloud operations  

    With NetApp storage solutions, the Korean managed cloud service provider offers a lean, intelligent architecture, …Read more
  • CISOs can navigate emerging risks from autonomous AI with a new security framework

    CISOs can navigate emerging risks from autonomous AI with a new security framework

    See how security leaders can adopt layered strategies addressing intent, governance, and oversight to manage …Read more
  • MoneyMe strengthens fraud prevention and credit decisioning

    MoneyMe strengthens fraud prevention and credit decisioning

    Australian fintech strengthens risk management with SEON to scale lending operations securely and efficiently.Read more
  • PT Kereta Api Indonesia announces nationwide email and communication overhaul

    PT Kereta Api Indonesia announces nationwide email and communication overhaul

    The state railway operator’s upgraded email system improves privacy, operational reliability, and regulatory alignment for …Read more

Bottom sidebar

  • Our Brands
  • DigiconAsia
  • MartechAsia
  • Home
  • About Us
  • Contact Us
  • Sitemap
  • Privacy & Cookies
  • Terms of Use
  • Advertising & Reprint Policy
  • Media Kit
  • Subscribe
  • Manage Subscriptions
  • Newsletter

Copyright © 2025 CybersecAsia All Rights Reserved.