Threat research has delved into their modus operandi involving two pathways: evasive social media investment scams and news spoofing and falsification.
On 29 April 2025, a network cybersecurity firm announced the identification of two cybercriminal groups that have been orchestrating large-scale scams using registered domain generation algorithms (RDGAs).
These groups employ automated techniques to create and register vast numbers of domains, leveraging well-known names and brands to make their campaigns appear credible and trustworthy.
By algorithmically generating and registering large volumes of domains, these two threat groups can complicate detection and blocking efforts. The domains are used for scams, phishing, malware, and spam, necessitating advanced security measures to defend against evolving threats.
Threat group profiles
The first group has been identified as operators of social media investment scams:
- Facebook ads are used to promote fraudulent investment platforms. Campaigns often feature fake celebrity endorsements and thousands of domains to evade detection.
- The malicious domains are configured so that any subdomain query returns a response, creating noise in DNS and making it difficult to identify which subdomains are actively used for scams.
- This threat group targets victims in Australia, New Zealand, and Taiwan, using localized content to increase the plausibility of their scams.
- The success of these investment scams often relies on creating a sense of urgency and sense of missing out.
The second group has been identified as operators of cloaking and spoofing services:
- Employing own cloaking service to perform validation checks on users, this threat group primarily target victims in Eastern Europe, impersonating real local news websites or prominent brands.
- Real news websites or major brands are spoofed by the group websites, such as Russian news sites or messaging platforms, to lure victims.
- This group uses constantly changing URL paths for scam landing pages, making them more difficult to trace.
According to Infoblox, the firm that disclosed its threat intelligence to the authorities, because the two groups of criminals use DNS exploitation for their campaigns, defenders can use DNS as a key element for security. Automated detection and correlation of scam domains at scale are important for effective defense. Preventing access to fake media and platforms using protective DNS services with robust threat intelligence can also help.
