Neanderthals

Neanderthals, as named by ESET researchers, is a threat actor group that uses the Telekopye Toolkit to execute sophisticated phishing campaigns. These scammers are primarily recruited via advertisements distributed across various online channels, including underground forums. They employ deceptive tactics and social engineering to convince their victims, referred to as "Mammoths," into sharing sensitive information. This process includes creating fraudulent listings on other websites, offering items or apartments at discounted prices, and then scamming the victims again via refund phishing emails when the promised goods or services are not delivered. The Neanderthals use a variety of methods to stay anonymous and increase their chances of successfully executing scams. They have been observed using VPNs, proxies, and TOR to maintain their anonymity. In addition, they use web scrapers to sift through online marketplace listings and select potential victims who are likely to fall for their schemes. For instance, in real estate scams, they create bogus websites with apartment listings and lure Mammoths into paying reservation fees by directing them to phishing websites. If a Mammoth prefers in-person transactions, the Neanderthals claim to be unavailable due to distance or business trips, all while demonstrating heightened interest in the item to increase the likelihood of the scam's success. ESET experts recommend awareness of the Neanderthals' tactics and caution on affected platforms as the best defense against these scams. They also advise the use of reputable anti-malware solutions to provide protection in case of being lured to a phishing website. By dissecting specific features offered by Telekopye and the different scam types it facilitates, ESET has uncovered the geographical areas these Neanderthals target and how they select their victims. The dynamics within and between various Neanderthal groups, their techniques, and their teaching methods have also been explored, providing valuable insights into their operations.