5 ms·
After the takedown of APT28, I continued to receive spam from IP ranges that were associated with APT29's malware campaigns. Turns out there's a lot of fake sh
by cookiengineer 2y ago
After the takedown of APT28, I continued to receive spam from IP ranges that were associated with APT29's malware campaigns.
Turns out there's a lot of fake shell companies that act either as hosting companies specifically for malware campaigns from Russia and China or specifically as a company that tries to fraud people, e.g. their CEO being on the FBI most wanted list or the company being sanctioned by the UN.
I'm currently creating some sort of cyber map of these spam/phish/malware campaign overlaps, as part of my antispam [1] effort.
I got tired of LLM based targeted spam where they have a system in place that is trained on my social media profiles, because they are very hard to identify as being spam.
Blocking specific domains is a useless effort because they keep on spawning new fake company domains that are either copies of legit ones or are generated fake profiles. They are so automated that they also create staff members and fake profiles on LinkedIn, specifically for that spam effort. Nobody at LinkedIn gives a shit about those fake avatars, I reported hundreds by now and they did absolutely nothing.
Anyways, long story short, here's the blocklist of those ASNs and companies. I'm working on the map at the moment and don't wanna publish it until I can prove its correctness:
[1] https://github.com/cookiengineer/antispam https://github.com/cookiengineer/antispam
- joelfried 2y agoThank you for doing this important work!
- c00kien1gg3r 2y ago[dead]
- igleria 2y ago> I reported hundreds by now and they did absolutely nothing. Ha. Same here but reporting a job ad that targets the dublin area, but it's really for bangkok. I hate it.
- nzach 2y ago> they are very hard to identify as being spam For every account I create on the internet I create a new mail inbox, this way I can just compare the email title with the inbox it was sent to. So, when I receive a notice from my bank on my github email I know what happened. This genuinely saved me a few times already.
- RandomBacon 2y agoSame, but I use a catch-all, not separate inboxes. I've caught a couple of hacked or sold email lists, but nothing that drastic yet. One organization posted the email address I gave them on a public contact list webpage, so I get spam/phishing at that one. Using a catch-all is the easiest way to do this, and I highly recommend it for other people.
- cafeinux 2y agoMay I ask what E-mail provider you use? Or do you run your own mail server?
- Moru 2y ago(not GP) Most providers let you run a catch-all adress on your own domain. You usually set it up with just a check-box "catch-all" and where to send all mail, or you write the username as "*" in an alias.
- mvolfik 2y agoNot GP either, but this. To name a specific provider, I use improvmx.com. They have a generous free tier, I eventually switched to some low paid tier. Not affiliated, happy user.
- RandomBacon 2y agoFastmail
- KarlKode 2y agoYup. Got my own domain(s) and use a different address for all my services (like with Gmail where you could append +service to your email but with a completely distinct email per service like paypal@mydomain.com). Helped my several times to identify spam & phishing without even having to check the E-Mail itself.
- 2y ago
- gphil 2y agoI also recently came across some of these fake company campaigns with attached employee profiles. It's very hard to distinguish them from legitimate companies. It's especially hard now that many legitimate companies use a lot of generic sounding AI-generated content, which seems to be same approach the spam/phish/malware teams are using. IMO we need some kind of zero-knowledge proof system that can be checked to verify if a message sender is a US citizen, employed by who they say they are employed by etc. I don't see how we can trust anything in a post-generative AI world any other way.
- deleted 2y ago[deleted]
- 0xDEAFBEAD 2y ago>IMO we need some kind of zero-knowledge proof system that can be checked to verify if a message sender is a US citizen, employed by who they say they are employed by etc. I think this could be a great opportunity for Google. Lots of organizations already make use of Google Workspace/Gmail. Imagine if Google Workspace offered the equivalent of a "Twitter blue check", where you pay extra, and anyone who views your email in Gmail sees a little check mark next to it, that shows Google verified you are who you say you are, and Google thinks you're not malicious. Salespeople sending cold emails would love it. I don't think you can solve this problem purely cryptographically. An attacker could always bribe a US citizen to set up a shell corp or whatever. Most objectively verifiable indicators can be gamed. There has to be an organization that's good at security, like Google, which is in the business of continuously keeping up with adversaries. Actually Google might not be the best because they kinda suck at tailored customer service, but anyway.