Telekopye

Telekopye is a sophisticated malware toolkit used by cybercriminals, particularly Russian hackers, to carry out broad phishing attacks. This malicious software, implemented as a Telegram bot, is designed to create fraudulent links, web pages, QR codes, and deliver convincing images via SMS messages in its phishing campaigns. The toolkit also aids in the creation of phony websites, phishing emails, and text messages. Its primary use has been observed in scamming users on online marketplaces, with the toolkit being leveraged by a suspected Russian threat operation known as Neanderthals. The Telekopye toolkit operates on a unique system that tracks each scammer's success, attributing individual contributions to a shared account. The payment structure from these accounts ranges from a 5% to 40% commission to the administrator, depending on the version of Telekopye used and the role of the Neanderthal. Additional commissions are given to those responsible for recommending the bad actor, followed by the final payout to the scammer. This structured approach has led to a high success rate for the scams facilitated by Telekopye. ESET researchers have provided in-depth analysis of Telekopye, dissecting specific features offered by the toolkit and the different types of scams it facilitates. They have also uncovered the geographical areas targeted by these Neanderthals and their victim selection process. In their discussions, they delve into the dynamics within and between various Neanderthal groups, highlighting how they train each other to effectively utilize the Telekopye toolkit for their malicious activities.