Los Angeles Court charges 80 Nigerians with BEC and Romance Scam Crimes

Bank of America, BBVA Compass, CalCom FCU, Capital One, Citibank, Citizens Bank, Comerica, Chase Bank, PNC Bank, Regions Bank, SunTrust, TD Bank, US Bank, and Wells Fargo Bank were among the financial institutions who were scammed by the 80 Nigerian criminals named in a Los Angeles indictment unsealed this week.  In this blog post, we'll introduce the case and share the first six of thirty victim stories that we'll continue over the next several posts.

FBI Los Angeles Technology Enabled Crime Task Force

In a press conference on August 22, 2019, the FBI Los Angeles Technology Enabled Crime Task Force shared a poster of the 16 Los Angeles residents charged in the case, 14 of which have already been captured.  Others residing in the US named in the case included residents of Houston, Texas, Orlando, Florida, Sacramento, California, Boston, Massachusetts, and Atlanta, Georgia.

According to the indictment, between October 7, 2014 through May 2, 2018 the 26 criminals charged in Los Angeles participated in mail fraud, bank fraud, and wire fraud by "transporting, transmitting, and transfering funds from place in the United States to a place outside the United States,"  "conducting and attempting to conduct, financial transactions, affecting interstate and foreign commerce," and ... "knowing that the property involved in the financial activity represented the proceeds of unlawful activity, and knowing the transactions were designed in whole and in part to conceal and disguise the nature, location, source, ownership, and control of the proceeds." They are also charged with "engaging and attempting to engage in monetary transactions involving criminally derived property of a value greater than $10,000, affecting interstate and foreign commerce."

Title 18 Section 1343 (wire fraud)
Title 18 Section 1341 (mail fraud)
Title 18 Section 1344(2) (bank fraud)

There are SO MANY STORIES to be told out of this indictment and the corresponding criminal complaint that it might take several days to get through them all.  The criminal complaint shares the details of thirty separate scams that are all connected, primarily via the two primary defendants, Valentine IRO and Chukwudi IGBOKWE.  Because of that, let's start with their first formal encounter with Law Enforcement on this case.

The July 19, 2017 Search Warrant (IRO, IGBOKWE, EROHA)

On July 19, 2017, the FBI served a search warrant at the residence of Valentine IRO's apartment. Having received no answer to their repeated loud knocking, they opened the door with a key provided by the landlord.  The reason no one was answering the door was because the residents were busy trying to destroy evidence.  Chukwudi IGBOKWE slid one window open and threw two phones (a gold iPhone 7 Plus (+1.323.509.0012) and a silver/white Samsung Galaxy Note 5 (+1.213.425.8827)) as far as he could, landing on the curb of the driveway to the apartment.  Meanwhile Chuks EROHA was throwing another cell phone (a black iPhone 7 Plus, +1.310.406.9386) into the yard of a neighboring property through another window.  While they were throwing phones out windows, someone else was trying to destroy a gold Samsung Galaxy (+1.424.2887.9250), which was found hidden under IRO's bed, bent nearly in half with a shattered screen, and damaged circuit boards and battery.  Other phones (a blue Samsung, +1.424.368.0611 and a sliver iPhone 6S Plus (+1.310.626.7033 / WhatsApp +234.816.165.6787) and tablet computers were also found in the search.

During the ensuing interview, IRO admitted to using the email accounts "enterpriseiro@gmail.com" and "valentino_q2000@yahoo.com" as well as controlling the bank accounts of the fraudulent companies "VOI Enterprises" at Chase Bank and "Irva Auto Sales" at Wells Fargo.  He claimed to have broken the phone after a fight with his wife, who he said was angry about him video-chatting with another woman.  This was one of several provable lies in the interviews. Data from IRO's broken phone was forensically recovered by the FBI Laboratory in Quantico, Virginia, which must have been quite a challenge, but was successfully accomplished!  The phone was used to receive messages 38 seconds and 39 seconds after the FBI hit the front door, which proves he had not destroyed it the previous day, as claimed.   EROHA also swore he had not thrown any phones.  IGBOKWE claimed he did not know anything about the fraud but that he did help his "wife", Tityaye MANSBANGURA, with her business of buying and selling cars.

(IRO was previously interviewed by the FBI on October 26, 2016 and November 23, 2016 about a wire transfer of $100,083.45 that was sent by a German victim company to his Chase VOI Enterprises account.)

A key finding in the phone reviews was that these guys NEVER DELETE DATA!  Three phones retrieved in the search warrant in contained Facebook Messenger messages dating back to March 2014, April 2012, and even 2010!  WhatsApp messages on one phone were as old as July 2015.

The ring-leader defendants, all found in the same apartment that morning in July 2017, IRO, IGBOKWE, and EROHA  would provide bank accounts to most of the others charged in this case, including: UMEJESI, OGUNGBE, EKECHUKWU, XPLORA G, OCHIAGHA, N. DURU, OFORKA, MARK CHUKWUOCHA, NNAMDI, CHILAKA, OHAJIMKPO, UCHE, ODIONYENMA, OGBONNA, ONWUASOANYA, MACWILLIAM CHUKWUOCHA, UZOKA, AWAK, EGWUMBA, EZIRIM, OKAFOR, SAM MAL, MBA, IKEWESI, OGANDU, ANYANWU, AZUBUIKE, NWACHUKWU, IZUNWANNE, OSUJI, ONYEKA, ANUNOBI, OKOLO, ONUWA, ISAMADE, MADUFOR, NNEBEDUM, OKEREKE, ODIMARA, ONUDOROGU, NZENWAH, OBASI, AGUBE, OKORIE, OHIRI, UGWU, AGWUEGBO, CHUKWU, MEGWA, IWU, CHIKA, MEZIENWA, AGUH, ESHIMBU, ANOZIE, AGUNWA, G. DIKE, UKACHUKWU, OSMUND, NWANGWU, AJAH, EJIOFOR, UBASINEKE, IBETO, NWANEGWO, E. DIKE, EKI, IWUOHA, C. DURU, and IHEJIUREME "into which they could fraudulently induce a victim to deposit funds from a BEC fraud, escrow fraud, romance scam, or other fraudulent scheme."

 UMEJESI, CATHEY, MANSBANGURA, AJAEZE, EKECHUKWU, OJIMBA, ISAMADE, and P. DURU, played roles in "opening or causing to be opened" new bank accounts.

 To do so, they would first file a "false and fraudulent Fictitious Business Name Statement" with the Los Angeles County Registrar-Recorder at the County Clerk's Office.

The list of 80 charged individuals is at the end of this post, but for now, let's jump straight to some of the stories of Business Email Compromise and Romance Scams that brought together this international gang of thieves.

Victim Company 1 - September 2014

A San Diego County distributor of clothes was communicating with a Chinese vendor about an order of men's shirts.  By hacking an email account at one of the companies, a fraudster implemented mail rules to block the real emails and injected himself into the middle of the communications.  The scammer caused the payment account for an invoice to be changed, resulting in a wire of $45,783.97 going to an HSBC Bank account (6100) controlled by scammers.

IRO (valentino_q2000@yahoo.com) and ONWUASOANYA (samuelnnamdi@rocketmail.com) communicated via Yahoo instant messenger about their roles in the chat, including sending a "cut and paste" email Onwuasoanya could use to forward to the victim company.

Personal Romance Scam Victim #1: M.S. 

M.S. a 61-year old woman in Monterey Park, California fell victim to a Romance scam on Facebook.  In May 2015, she met "Dennis Hunt" (his Facebook name) who claimed to live in London and work in real estate construction.  He communicated with M.S. via Facebook messenger and two +44 (UK) telephone numbers.  M.S. loaned "Dennis Hunt" money for a new project, which totaled $111,200.  $91,200 was sent to IRO's Chase account in the name "VOI Enterprises" which attempted to disguise the money by claiming to be dealing in used automobiles.

 Sep 3, 2015: OI ENTERPRISES acccount opened: Chase 9837
 Sep 3, 2015: $23,000 sent from MS BOA Account to IRO's Chase 9837
 Sep 4: 2015: $14,000 withdrawn from Chase 9837 memo "for Lexus RX330 and RX300"
 Sep 4, 2015: $1500 sent to relative from Chase 9837 memo "2002 Nissan Optima"
 Sep 8, 2015: $46,500 sent from MS BOA account to Chase 9837 account
 Sep 8, 2015: $8,000 withdrawn from Chase 9837 memo "Mercedes 2011 and Lexis RX 350 2008"
 Sep 10, 2015: $30,000 withdrawn from Chase 9837 memo "for Acura MDX 2007"
 Sep 10, 2015: $9,000 withdrawn from Chase 9837
 Sep 10, 2015: $4,700 sent from MS BOA Account to IRO's Chase 9837
 Sep 11, 2015: $7,700 check sent from Chase 9837 to a friend memo "Camry 207 and Camry 05"
 Sep 14, 2015: IRO sends OGBANNA instructions to have MS wire a payment "Invoice number: VOI00462 R MODEL 89"
 Sep 14, 2015: $17,000 sent from MS BOA to Chase 9837 memo "Invoice number: VOI 00462 R MODEL 89"
 Sep 17, 2015: $10,000 withdrawn from Chase 9837
 Sep 17, 2015: $20,000 withdrawn from Chase 9837
 Sep 17, 2015: $5,000 withdrawn from Chase 9837

 Victim Company 2 - February 2016 BEC Fraud

A company in Texas was tricked into sending $186,686 from its account at UBA to IRO's Chase VOI Enterprises account.  The company had ordered some oil extraction equipment and was sent bank account information as to where to send the funds.  A few hours later, the Texas company received new communications, indicating the previous banking details were incorrect and providing new account information.  (The new email's headers reveal they were sent from Nigerian IP addresses.)

 Feb 12, 2016 $186,686 from United Bank of Africa account to IRO's Chase 9837 Account
Feb 16, 2016 $132,950 wired from that account to Wells Fargo "Irva Auto Sales Account" memo "Mack Rd Model 2010 X"
Feb 16, 2016 $50,000 send from Wells Irva Auto to BOA account 1824 "Bernards International"
Feb 18, 2016 IRO withdrew $50,000 cash from BOA 1824.
Feb 18, 2016 IRO wires $30,500 to Chase 1279.
Feb 16, 2016 $28,670 wired to CalCom FCU account 3017 memo "Menhien Auction on Wednesday"

(The Texas company recovered $55,593.18 of that amount, but only after spending $50,000 in legal fees pursuing the matter with Chase.)

Personal Romance Scam Victim 2 - R.B. 

R.B. was a 48 year old woman living in Panama City Beach, Florida who was recently widowed.  She began an online romantic relationship with a doctor in the US Military, stationed in Libya, who was a widower.  He claimed to have a five year old daughter and that his parents were killed in the Twin Towers attacks on 9/11.

R.B. sent three wires from her Wells Fargo account
Mar 31, 2016 - $18,000 to the Comerica account 2663 of IRVA Auto Sales
Apr 4, 2016 - $39,000
Apr 7, 2016 - $30,000

Several cash withdrawals were made from Nashville, Tennessee from the Comerica account.  $55,024.19 of the total amount was frozen by Comerica and returned to R.B., who reports that she considered suicide when learning she ahd been scammed.

IRO discussed his fraud against R.B. using his email enterprisesiro@gmail.com.  AWAK created false invoices to help launder the funds from the Auto Sales account.  ODIONYENMA emailed IRO a photograph of the wire transfer, including R.B.'s transfer request and her Florida driver's license number, address, phone number, and Wells Fargo bank account details.  AWAK also communicated about laundering these funds using the name "HANOI BATTERY JSC" and the email ccs03h@gmail.com.  AWAK also used the name "Kwee Tin Law" with that email address.  He provided invoices for IRO to use, one of which used IRO's residential street address (412 Gina Dr., Carson, California) with the name "IRVA Auto Sales Equipment Broker LLC."

Personal Romance Scam Victim 3 - F.K. 

F.K. was a Japanese woman who became involved in a 10-month online romance scam. She believed she was "dating" Terry Garcia, a US Army captain stationed in Syria.  They met on "InterPals" and communicated almost daily via Garcia's Yahoo email address.  They communicated in English, which F.K. used Google Translate to assist with.  Eventually, Garcia was wounded in Syria, but his friend Collins Coster, a Red Cross employee, had been given a box of diamonds with instructions that Garcia wished them to be sent to F.K.  Owen Blair, the shipping consignment officer, contacted F.K. to arrange the payments for the customs fees for the box of diamonds.  Unfortunately, another fee was required for the diamonds to enter customs in Japan.  Diplomat Romain Kaufman helped her arrange, via gmail, her "diplomatic consignment tax" of $28,750.  F.K. continued to make various payments as the crazy scheme escalated.  She received emails as often as ten to fifteen times per day, and made "35 to 40 payments" which caused her to need to borrow many from friends, her older sister, her ex-husband, and even a bank loan.

F.K. paid:
April 11, 2016 - Western Union of $2000 sent to Turkey for "customs non-inspection fee"
April 11, 2016 - Western Union of $6,200 sent for "final accreditation fee"
late April - bank transfer of $28,750 sent to a bank in Turkey for "diplomatic consignment tax"
May 30, 2016 - Wire of $6,824.00 to Chase account 1577
July 13, 2016 - Wire of $33,128.26 to Chase account 0655

 Not only did she send $200,000 to the scammers, to bank accounts controlled by IGBOKWE and MANSBANGURA, she was also lured to Los Angeles for the purpose of convincing a bank to unfreeze her wire transfer!  She was told that a Russian bank manager in Los Angeles had embezzled the funds.  Defendants ANUNOBI was also involved in arranging some of this scam.
On October 13, 2016, MANSBANGURA took photos of F.K. after meeting her at the airport and sent them to IGBOKWE saying "This is her" and later "I just drop her off. I'm not doing this again."

Personal BEC Victim 4 - J.G. 

J.G. was an attorney from Nevada.  A potential client "Frank Moss" claimed to have a construction company in Omaha, Nebraska, and needed J.G.'s help purchasing some equipment.  Moss said that he didn't want to make the purchase directly and needed the help of a lawyer to make the purchase.  Moss sent a check for $30,750 to J.G., who wired $30,000 to a US Bank account (2669) in the name M&F Enterprise.  Because J.G. had over $100,000 in his account, he didn't wait for the check to clear, which had a hold on it because it appeared to come from a Canadian bank.  Defendants MANSBANGURA and IGBOKWE were in control of the receiving account.

Oct 26, 2016 - $30,000 wired to US Bank 2669.
Oct 27, 2016 - $5,500 from that account paid to MANSBANGURA
Oct 27, 2016 - $7,850 from that account paid to an unindicted co-conspirator
Oct 28, 2016 - $8,845 from that account paid to an unindicted co-conspirator
Oct 31, 2016 - $7,500 from that account paid to MANSBANGURA

IGBOKWE sent several text messages from his iPhone 6S and Samsung phone sharing account details of the US Bank 2669 account to allow others to use it as well.

BEC Criminals Indicted in Los Angeles

In total, 80 individuals were charged.  In the list below, we've indicated those in the United States by placing *asterisks* around their number.  Many of the individuals in the Los Angeles area were brought into the case by exploring the chat logs and emails recovered from the phones on that initial search warrant and "spidering out" from there with additional records checks at Uber, Lyft, Google, Apple, Facebook, Microsoft, and Instagram.

• *1*. VALENTINE IRO, aka “Iro Enterprises,” aka “Valentine Obinna Iro ,” aka ” Obinna Iro ,” aka ” Obinna Nassa,” - 424.287.9250 / 412 Gina Drive, Carson, California.
• *2*. CHUKWUDI CHRI STOGUNUS IGBOKWE, aka ” Christogunus C. Igbokwe,” aka ” Chris Kudon ,” aka “Atete ,” aka “Still Kudon ,”
• *3*. JERRY ELO IKOGHO , aka “J Man,” +1.323.308.0042 - in Valentine IRO's address book as "J.Man" - Confirmed via T-Mobile records, showing address 17630 Crabapple Way, Carson, CA 90746 - confirmed also by DMV records.  ikoghojerry@gmail.com also was registered to this telephone number, with recovery email ikoghojerry@yahoo.com.  The gmail and telephone were also used for accounts at Facebook, Uber, and Lyft.  Other numbers:  +1.646.651.6077.  Invited IRO to his 4th of July barbecue in 2017.
• *4*. IZUCHUKWU KINGSLEY UMEJESI, +1.323.209.9682.  In IRO's Samsung address book as "Armenian Man".  In IGBOKWE's iPhone address book as "Kingsley LA".  In EROHA's phone as "Izuking Aka Aku."  Financial records give his address as 2319 W. Florence Ave, Los Angeles, CA.  Records tied to that number list his birthday, driver's license, and Nigerian passport number.  He also filed a police report using that name, telephone, and address after his Dodge Charger was broken into.  The number was also used by Uber, Lyft, Yahoo, and Facebook accounts.
• *5*. ADEGOKE MOSES OGUNGBE.   IRO's Samsug gives +1.310.756.5633 as P&P Motors.  IRO also listed +1.310.773.8266 as "Pp." T-Mobile says OGUNGBE used the first number since April 3, 2012 at the street address 17260 Farwell St., Fontana, California.  His silver Lexus, registered to P/P Motors, LLC, was observed at that address.  That number was used in WHOIS data to register pandpmotorsllc with GoDaddy.com with the email adegoke101@gmail.com.  Google used the name "Moses Ogungbe" for that user, with the 5633 telephone.  The Instagram account "pandpmotors" used "Adegoke Moses Ogungbe" as the registered user.  Uber and Facebook also tie this user to the 5633 phone.  T-Mobile lists the 8266 number as his from Feb 6, 2016 to June 12, 2018.   P&P and PP both chat with IRO about personal matters, including referring from one phone number as saying "Na my second phone dey  my hand."
• 6. ALBERT LEWIS CATHEY.  IRO's Samsung has three numbers for CATHEY.  +1.323.359.5052 ("Alb"), +1.310.484.3117 ("Albert Jag"), and +1.310.242.0179 ("Al").  The 5052 number ties CATHEY to the phone in Inglewood, California from Oct 15, 2012 to June 28, 2017. His DMV records and Sprint records also tie him to the address.  His iTunes account gives his email as "ac.lu@aol.com" with the same Inglewood address.  His Apple account was later linked to "blueheaven3223@gmail.com" which he used to communicate with IRO.  "Albert Jag" and IRO spoke almost daily from Feb 17, 2017 to March 31, 2017, with less frequent comms starting in September 2016.   They discussed bank accounts in both India and China used in frauds.  The "0179" number was registered to CATHEY's girlfriend, with her addresses in Lawndale and San Pedro, California.  CATHEY opened a business bank account for a fictitious Ghanaian oil company for IRO, linked to the "3117" number.  The "0179" number is also used to open  two business accounts at Comerica Bank.
• *7*. TITYAYE MARINA MANSBANGURA, aka “Tityaye Igbokwe ,” aka “Marina Mansour,” aka “Marina Mansaray,” aka “Marina Tityaye Mans Bangura."  MANSBANGURA used at least sixteen different telephone numbers to communicate with IRO, IGBOKWE, and EROHA between October 2016 and July 2017.  +1.310.279.0880, +1.310.527.1235, +1.310.806.3646, +1.310.904.3858, +1.310.904.8073, +1.310.920.7285, +1.310.920.8666, +1.310.447.4893, +1.424.376.4052, +1.424.376.7261, +1.424.376.7260, +1.424.305.9393, +1.310.954.6109, +1.424.376.9179, +1.424.376.9219, and +1.424.376.8558.   At one point when she began having trouble opening bank accounts ("All the banks have blocked me.") IGBOKWE told her that IRO knew someone who could get her a new passport and social security card "in four days."
• *8*. CHUKWUDI COLLINS AJAEZE, +234.818.517.4075 was in IRO's phone as “Thank You Jesus.”  Tango, a messaging app, ties that phone to "Collins Eze 2" and the email "ajaeze@gmail.com".  Google records for that subscriber gave the name "Chuckwudi Collins Ajaeze" with the telephone +1.424.227.0030 and the recovery email "tm.haily10@yahoo.com".  That US telephone number is tied to many bank accounts, including a Chase account (0038) and a Wells Fargo account (1849).  Facebook, Uber, and Lyft all link the email to Ajaeze as well.  At least six bank accounts opened by AJAEZE list IRO's apartment as the address.  (Wells Fargo accounts 3087, 7748, 912, and 1849), Bank of America account (5957) and Chase account (0038).
• *9*. EKENE AUGUSTINE EKECHUKWU.  +1.562.328.9622 was listed in IRO's phone as "Power" and in IGBOKWE's phone as "Ogedi Power."  IRO and Ogedi Power discussed problems with a wire transfer in a March 2017 chat.  ("What's your name? Ekenne Williams?" No. Ekene Ekechukwu.  "Ohhh! I gave them Ekenne Williams ... I made a mistake on your name!")  A Facebook account (Austine Dee) and an Instagram account (Austine) tie to the same number.  Uber and Lyft accounts for that number give the email "fatherkee@hotmail.com." Microsoft says that email belongs to "Augustine Ekechukwu."
• 10. CHUKS EROHA, aka “Chuks Nassa Iro,” aka “Nassa,” aka “Prince Chuddy,” aka “Nurse Chuddy,”
• 11. COLLINS NNAEMEKA OJIMBA, aka “Collins Emeka Ojimba,” aka “Ojimba Collins." IRO had +1.323.317.7383 in his Samsung phone listed as “Charly.Africa."  That number was in T-Mobile's records belonging to OJIMBA since June 4, 2011, with a Hawthorne, California address.  OJIMBA opened multiple bank accounts for IRO, including US Bank (1837) and Wells Fargo (7776), the latter in the name of "C and K Business Enerprise" [sic, "t" missing].
• 12. FNU LNU, aka “Xplora G,”
• 13. UCHENNA OCHIAGHA, aka “Urch Agu,” aka “Advanced Mega Plus Ltd,”
• 14. NNAMDI THEOJOSEPH DURU, aka “Duru Theo Joseph Nnamdi,” aka “Williams High School,” aka “Ifytyns,”
• 15. ERICSON UCHE OFORKA, aka “Oforka,” aka “Eric Oforka,”
• 16. MARK IFEANYI CHUKWUOCHA, aka “Mark Iheanyi Chukwuocha,” aka “Chukwu Mark,” aka “Markife,”
• 17. AUGUSTINE NNAMDI, aka “Nnamdi Augustine,” aka “Jazz,”
• 18. CHIEMEZIE CHRISTOPHER CHILAKA, aka “Fanta,”
• 19. CHARLES OHAJIMKPO, aka “Giggs,” aka “Ryan Giggs,” aka “Charles,”
• 20. STANLEY UGOCHUKWU UCHE, aka “Ugo Law,” aka “Uche Stanley,” aka “He is risen.Happy Easter!,”
• 21. CHIKA AUGUSTINE ODIONYENMA, aka “Tony Augustin Odionyenma,” aka “Chika Tony,” aka “CTA Finance Source Intl,”
• 22. PASCHAL CHIMA OGBONNA, aka “Chima,” aka “Paschal,”
• 23. SAMUEL NNAMDI ONWUASOANYA, aka “Sammy Lee Nnamdi,” aka “Onwuasoanya Samuel Nnamdi."  Sammy was in IRO's phone as “Enugu Ogo" with the number +234.816.505.6552.  Sammy's website was discovered which listed his birthdate and email "samuelnnamdi@rocketmail.com."  Yahoo (who owns RocketMail) lists Mr. Samuel Nnamdi as that account holder.  IRO's enterprisesiro@gmail.com corresponded with Nnamdi at that address, including wire transfer information and proofs of payment.  "Sammy Lee Nnamdi" was also listed in IRO's and EROHA's phones with the same number.
• *24*. MACWILLIAM CHINONSO CHUKWUOCHA, corresponded with IGBOKWE using the name “ChiBoy" from the phone +1.407.233.7717.  He said he was in Orlando, Florida, when chatting from the same number to IRO.  He used his true name when opening an Orlando, Florida Wells Fargo account (5736).  T-Mobile indicates the number belonged to "Amcwilliam Chukwuocha" from November 25, 2016 to March 20, 2017.  IGBOKWE's other phone listed this number in its contacts as "Macwilliam" in his "imo" messaging application.  "imo" shows the account to use the email "macwilliam123chukwuocha@gmail.com" and the same telephone number.
• 25. EMMANUEL ONYEKA UZOKA.  IGBOKWE's phone listed UZOKA as "Mansion" (+1.470.338.6848) and also  “Son of God” (+1.646.457.6954). aka “Ezirim Uzoma").  IGBOKWE texted UZOKA and mentioned visiting Atlanta.  UZOKA provided his home address, 1405 Station Club Dr. SW, Marietta, Georgia 30060, which matches his driver's license address.  They discussed a $52,000 transfer in one chat.  T-Mobile ties the 6848 number to UZOKA at the same address.  UZOKA's Facebook and Instagram pages have photos matching ones he sent to IGBOKWE.
• 26. JOSHUA ANIEFIOK AWAK.  IRO's Samsung lists +234.808.0265.5259 as "Joe Awk".  He provided a Nigerian Guaranty Trust Bank account to IRO via chat, confirming he received a transfer.  The same number was on a business card AWAK provided to CBP when entering LAX airport following an inbound flight.  He told CBP he would be visiting IRO and provided two of IRO's telephone numbers to them, including the primary (+1.424.287.9250.)  Google has that number listed for "awak.joshua@gmail.com" with a recovery address of "joshuaawak@icloud.com."  Yahoo lists him as "joshuaawak@yahoo.com" with many telephone numbers and additional email addresses, including "ccs03h@gmail.com" which supplied the fraudulent invoice for victim R.B. above.  A Chase Bank investigator also provided the telephone number +1.786.872.2885 that linked AWAK to the email awak.joshua@gmail.com in their records.
• *27*. GEORGE UGOCHUKWU EGWUMBA. IRO listed "George Ugo" as +1.714.916.1760, while EROHA had the same number as "Ugo Aunty Scholar."  Facebook ties the number to a "George Egwumba" account with the emails smillinggeorgeconsult@yahoo.com and egwumbag@yahoo.com.  Apple ties the number to the latter address, as well as "wingaldnigeria.ent@gmail.com".  A Nigerian telephone number, +234.803.374.3079, is also used in both Apple IDs.  The Yahoo id confirms the Nigerian telephone number, but also gives the name "Mr. George Bent."
• 28. UCHECHUKWU SOLOMON EZIRIM, aka “Uche Nwanne,” aka “Uche Ezirim,”
• 29. AUGUSTINE IFEANYI OKAFOR, aka “Zero,” aka “St.Austine,” aka “Austine,” aka “Ifeanyichukwu Okafor,”
• 30. FNU LNU, aka “Okay Sam Mal,”
• 31. LESLIE N. MBA, aka “Mystical,” aka “Nwachinemere Leslie,”
• 32. OGOCHUKWU INNOCENT IKEWESI, aka “Ogoo UK,” aka “Innocent Ikewesi,”
• 33. EMMANUEL UZOMA OGANDU, aka “Nwachinaemere,” aka “Uzoma,”
• 34. AMARACHUKWU HARLEY ANYANWU, aka “GodisGod,” aka “War B,”
• 35. BRIGHT IFEANYI AZUBUIKE, aka “Bright Bauer Azubuike,” aka “Ifeanyi Jnr,”
• 36. EMEKA MOSES NWACHUKWU, aka “All Man,” aka “Omalitoto,”
• 37. FNU LNU, aka “Donatus Izunwanne,” aka “Izunwanne Donatus Chibuikem,” aka “Deworlddonmax,”
• 38. CHINWENDU KENNETH OSUJI, aka “Father,”
• 39. EUSEBIUS UGOCHUKWU ONYEKA, aka “Ugo UK,” aka “sly19 sly,”
• 40. CHIDI ANUNOBI, aka “Anunobi Chidi,” aka “Chidioo,”
• 41. ANTHONY NWABUNWANNE OKOLO, aka “Eric West,” aka “Erci West,” aka “Code,”
• 42. OBINNA CHRISTIAN ONUWA, aka “Papa Chukwuezugo,” aka “Obinna Onuwa Abala,” aka “Obyno Abala,”
• 43.  CHIJIOKE CHUKWUMA ISAMADE, aka “Mr CJ,” aka “CJ,”  IRO's broken phone listed +1.415.530.9429 as "Cj" and had communicated with +1.707.490.1571.  The 9429 number was in IGBOKWE's phone as "Mr CJ." who was also listed as "Mr. CJ" with the Nigerian phone number +234.809.115.3589.  AT&T links the 9429 number to "Chijioke Isamade" in Sugar Land, Texas. He used the email "princeisamadecj@outlook.com" and "mrpincecj@icloud.com on two Uber accounts tied to the 1571 telephone number.
• 44. LINUS NNAMDI MADUFOR, aka “Madufor Nnamdi,”
• 45. CHRYSAUGONUS NNEBEDUM, aka “Cris,”
• 46. UGOCHUKWU OKEREKE, aka “Blade,” aka “Kingsly Cris,” aka “Okereke Ugochukwu,”
• *47*. FIDEL LEON ODIMARA.  IGBOKWE listed +1.713.366.6633 variously as "Ndaa", "Fidel Odimara", "Dee Dutchman", "dutchman dee", "Ndaa USA", and "amusan olubunmi" in his various devices.   The T-Mobile records for the number tie it to "Fidel Odimara" at 10555 Turtlewood Court, Houston, TX 77072 since 21OCT2015.  Wallis State Bank had all of the same information listed for a business bank account in the name "General Auto USA."   Uber tied the phone number to fidelleo2005@yahoo.com, which Yahoo listed as "Mr. fidelo Jackson" with an alternate email of "generalegroup@yahoo.com."  That email had in turn the alternate email "generaloilservices@yahoo.com" in the name "Fidel Odimara."Instagram listed his account name as "De Dutchman" with the vanity URL /dedutchman, tied to the generalegroup@yahoo.com email address.
• 48. KINGSLEY CHINEDU ONUDOROGU, aka “OBJ,”
• 49. DESSI NZENWAH, aka “Desmond Sage,” aka “Des Nzenwa,” aka “Saga Lounge,”
• 50. CHIMAROKE OBASI, aka “Chima Russia”
• 51. JAMES CHIGOZIE AGUBE, aka “Smart,” aka “Smart Agube,” aka “Smart Chigozie Agube”
• 52. CHIMAOBI UZOZIE OKORIE, aka “Omaobi,” aka “Mobility,”
• 53. OGOCHUKWU OHIRI, aka “Ogomegbulam Ohiri,” aka “Ologbo,”
• *54*. KENNEDY CHIBUEZE UGWU, aka “Kennedy David,” was listed in IGBOKWE's phone as 1.781.654.5154, with additional numbers of +1.781.654.5154 and +1.347.393.1600, using the named "Kennedy", "Kennedy USA", and "Kennedy Ugwu."  The 5154 number was used in chats discussing payments with IGBOKWE, who stated that he lived in Brockton or Boston Massachusetts.  These phone numbers also were tied to the Facebook account for "Kennedy David."  "Northeast Security Inc" confirms that Ugwu was an employee and used a Brockton, MA street address, the 5154 telephone, and the email "kennedyugwu22@gmail.com" in his employment records.  his Facebook vanity URL was "kennedy.ugwu.7" and the same email given by his employer.
• *55*. IFEANYICHUKWU OLUWADAMILARE AGWUEGBO.  IGBOKWE had AGWUEGBO in his phone as “B$$ IFF¥” with the number +1.401.536.0073.  A Wells Fargo investigator shows him using that number with the street address 8907 Deer Meadow Dr., Houston, TX 77071 to open an account ending in 2016.  He conducted at least five financial transactions related to this case, all using the same telephone and street address, including some using a Bank of America account (1769).
• *56*. VICTOR IFEANYI CHUKWU. +1.323.237.4383 was listed in IGBOKWE's phone as "Vic," "Vic Chux", and "Anyi LA," in IRO's phone as “Ifeannyi Soccer,” and in EROHA's phone as "Ifeanyi."   In a text to IRO he says "my name is victor chukwu and I live in Los Angeles, California."  Chuckwu was interviewed by the FBI and provided an email "ifydiddy@yahoo.com" listed as belonging to Mr. Ifeanyi Chukwu, with the same phone.  Uber listed him as a driver, using that phone and the email "vic.chukwu@yahoo.com".  Lyft shows him as ifydiddy@yahoo.com.
• *57*. CHIDI EMMANUEL MEGWA.  IGBOKWE calls 1.754.213.6149 "Cantr,” in his contacts on one phone and "Canta Jr." with the number +1.682.414.1984 on another phone.  His Facebook account links him to emails "jaz_y2004@yahoo.com," "megwaemmanuel@yahoo.com," and "kodioluvsu@yahoo.com." Lyft has him listed as "Chidi Emmanuel" with the email "megwachidi@gmail.com" and after the 6149 number, also +1.682.347.0113.  His DMV photo matches images of him shared by SMS picturing him at a club with IGBOKWE and EROHA.
• *58*. PRINCEWILL ARINZE DURU.  IGBOKWE had the number +1.916.997.9097 listed for DURU.  The two traded information about a Chase Bank account (2101), which Chase confirmed with this telephone number and the email princeeznira@gmail.com.  Sprint lists him as "Princewill Duru" in Carmichael, California.  Bank of America account (4859) in the name "PD Enterprise" showed DURU as the account holder with emails pdenterprise2017@gmail.com and princeduru22@yahoo.com.  Google lists a backup address for princeeznira as princeduru22@yahoo.com (in the name "King Eznira", which is "Arinze" spelled backwards, but also a pun on making "easy naira" (the currency of Nigeria.)
• 59. ESMOND IWU, aka “Desmond Chigozie Iwu,” aka “Lalaw,” aka “Odo Desmond,”
• 60. YEKA VINCENT CHIKA, aka “Chyco,” aka “Chika Ejima,” aka “Vincent Chika Onyeka,”
• 61. FEANYI KINGSLEY MEZIENWA, aka “Ifeanyi Ali,” aka “Ifeanyichukwu Mezienwa,”
• 62. VICTOR UCHENNA AGUH, aka “Orch Sod,” aka “Uche SP,” aka “Rich Homie Urch,”
• 63. KEVIN AMARACHI ESHIMBU, aka “Humble,” aka “Humble Amarachukwu,” aka “Dato Humble,”
• 64. VITALIS KELECHI ANOZIE, aka “Kelechi Vitalis Anozie,” aka “Kelechi Anozieh,” aka “Pastor Kel Anozie,” aka “Pastor Kc,” aka “Choice,”
• 65. WILLIAMS OBIORA AGUNWA, aka “Don Williams,”
• 66. GEORGE CHIMEZIE DIKE, aka “Chimekros,” aka “Slim Dad…No…1,”
• *67*. MUNACHISO KYRIAN UKACHUKWU.  IGBOKWE's phones list +1.510.417.7578 as "Muna" and in his "imo" messaging app as "Muna Ukachukwu."  Twitter and imo give the email "munaukachukwu@gmail.com" and confirm the telephone number for Twitter accounts @Munachiso18 and @MunaUkachukwu.  The same information is used for a Skype account.  T-Mobile places him at 366 Ohio Ave, Richmond, California and a previous address, also on Ohio Avenue, matches his California DMV record.  He was a Lyft driver as well, using the same phone and email munac_2000@yahoo.com.
• *68*. NWANNEBUIKE OSMUND.  +1.424.672.0859 is in IGBOKWE's phone as "Olivite" while EROHA lists him as "Nikky Bros." and IRO as "Nikky Bro."  T-Mobile places him in Carson, California, as does the DMV.  Yahoo ties that phone to nwannebuikeosmund@yahoo.com.
• 69 CHIDIEBERE FRANKLIN NWANGWU, aka “Frank Chidi,” aka “Franklin Nwangwu,” aka “Agogo,”
• 70. DAMIAN UCHECHUKWU AJAH, aka “Uche Ajah,” aka “Ajah Damian Uchechukwu,” aka “Uchechukwu Demian Ajah,”
• 71. MEKA P. EJIOFOR, aka “Ejiofor Emeka,”
• 72. LAWRENCE CHUKWUMA UBASINEKE, aka “Ubasineke Chuks,” aka “Chukwuma Ubasineke,”
• 73. CHINEDU BRIGHT IBETO, aka “Doggy,” aka “Doggy Lucino,”
• 74. VALENTINE AMARACHI NWANEGWO, aka “Satis,” aka “Satis Amarachi Satis,”
• 75. EMMANUEL CHIDIEBERE DIKE, aka “Emmanet,”
• 76. JEREMIAH UTIEYIN EKI, aka “Uti,”
• 77. CHINAKA DAVIDSON IWUOHA, aka “Tmrw Afrika Will Wake Up,” aka “Cookie,” aka “All Africa Media Network,”
• 78. CHIMA DARLINGTON DURU, aka “Kajad,” aka “Kajad Jesus,”
• 79. IKENNA CHRISTIAN IHEJIUREME, aka “Piper,” aka “Am Happy!,”
• 80. OBI ONYEDIKA MADEKWE.  +234.703.472.4857 is in IRO and IGBOKWE's phones as  “Odu Invest" and "Obi LA."  +1.310.658.4080 is also in IRO's phone as "Obi Soccer."   Madekwe introduced himself by name in chat, and opened a Wells Fargo account (1223) in his own name.  He used the email omadekwe1@gmail.com and the 4080 telephone number.  Google links that email to the +234 phone.  IRO complains that his "Main Exchanger" has gone to Nigeria in April and May of 2017.  DHS confirms MADEKWE traveled to Nigeria in April 2017.

Yahoo reveals coordinated attack on Yahoo Emails - encourages Password reset

On January 30, 2014, Jay Rossiter, the Senior Vice President for Yahoo's Platforms and Personalization Products shared An Important Security Update for Yahoo Mail Users on the companies Tumblr blog. In this time when "breach" is the biggest buzzword on the Internet, let's look at what the post is saying and is not saying and consider what we can learn and what we should do as a result of this information.

(click image to visit Yahoo! blogpost)

Is Yahoo a breach victim? or a champion?

(Quote): Recently, we identified a coordinated effort to gain unauthorized access to Yahoo Mail accounts.(/Quote)

While we don't know how they discovered this, the typical methods for discover would be some form of network analytics showing single IP addresses or sessions attempting to access multiple Yahoo email accounts in rapid succession, or, based on the keyword "effort", possibly attempting and failing generating a large number of password guesses. Like most Email Service Providers, Yahoo! retains records of which IP addresses have previously succeeded to access your email account, and a sudden spike in "wrong address / wrong device / wrong geography" alerts may be part of what led to the conclusion this was a coordinated effort.

While everyone is raging at Yahoo!, I believe that in this situation Yahoo! is providing a well-intentioned public service that actually reveals a pro-security stance in the company, NOT a weak security status! Read on to see why.

Password Re-Use is the Problem

Next, where did the data come from and what type of data was it?

(Quote): Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise. We have no evidence that they were obtained directly from Yahoo's systems.(/Quote)

On face value many are jumping to the conclusion that this indicates that Yahoo! is allowing some third party to store userids and passwords of Yahoo! users on their systems. Again, as an outsider sharing my reasoning on this event, I don't believe that is what is being said. PASSWORD RE-USE IS REACHING CRISIS LEVELS!. Oops? Did I scream that? I guess I did! The problem that I believe we are dealing with here is that many systems on the Internet ask you to use your EMAIL ADDRESS as your UserID on their system. This is a great convenience in many ways, however, in this case, it also means that a criminal now can associate your userid on one system in a very direct way to your userid on your email provider's system. MORE THAN 81 MILLION AMERICANS (and more than 200 Million people worldwide) still use a Yahoo! email account! This means that in any breach on any system where your userid is equal to your email account, there is a very great chance that the primary accounts found in that breach would be Yahoo email accounts. Despite repeated warnings, most users still use the same password on ALL of their systems. Because of this, it is logical for a criminal who obtains userids and passwords from ANY source to try those same userids and passwords at Yahoo against the matching email account.

What is the Criminals' End-Game?

(Quote): The information sought in the attack seems to be names and email addresses from the affected accounts’ most recent sent emails.(/Quote)

If someone is using the same userid and password on multiple systems, it is likely they are doing so on many ADDITIONAL systems as well. By reading the recent emails found in the Inbox and Sent mail, the criminals are likely able to determine other places where the Yahoo email user has additional accounts. For example, when I make a purchase on Amazon.com, BestBuy.com, Delta.com or pay my credit card bill at Citibank.com or BankofAmerica.com what happens? They send a confirmation of my purchase (or my statement) to my email account. If a criminal knew that information, they would be able to then try that same Yahoo email account as the userid and password and attempt to access those other accounts. In addition, how do ALL of those service confirm a password reset account? Through an email message with a "click to change your password" link. Since the criminal now has control of your Yahoo account, even if you DID use a different password, they can now reset it at will!

Of course there is also the possibility that they are just after "London traveler" type scams where knowledge of the individuals in your address book is used to send personal pleas for financial assistance due to some type of crisis. We've covered those types of scams since at least 2009 in this blog. The more recent social engineering attacks that we've heard of have been searching the compromised accounts for evidence of communications with bankers and then using the knowledge of the previous conversation to ask for financial favors or skirting of the rules to help perform a financial transaction via email.

How is Yahoo Protecting their Customers?

This is from their letter, but it is exactly what I would hope they would do after detecting this situation!

(Quote:)
• We are resetting passwords on impacted accounts and we are using second sign-in verification to allow users to re-secure their accounts. Impacted users will be prompted (if not, already) to change their password and may receive an email notification or an SMS text if they have added a mobile number to their account.
• We are working with federal law enforcement to find and prosecute the perpetrators responsible for this attack.
• We have implemented additional measures to block attacks against Yahoo’s systems.

(/QUOTE)

Jay Rossiter is also trying to help educate Yahoo! users by recommending this page of suggestions for Safeguarding your Yahoo account. Whether you are a Yahoo! user, a Gmail user, a Live.com/Outlook365 user, or whether you are just using your corporate email account, the advice given there is well worth reviewing and following.

In the Safeguarding Your Yahoo! Account document, I'd like to call special attention to their recommendation to having an alternative email and mobile phone on file with Yahoo. This isn't so they can violate your privacy. It is so they can better protect your account! I've used this service myself from Yahoo within the past two weeks and was very pleased that they texted a password reset code to my cell phone before allowing a password change request to continue.

High praise to Yahoo! for recommending that you enable a mobile-phone based password reset. I wish my banks and credit card issuers would require the same! This isn't an example of Yahoo! being a security victim, but being a security LEADER! It is shameful that my Yahoo! email account is better protected than many other accounts! (Test your own accounts: Can you click an "I Forgot My Password" link on your bank/electronics/music website to reset your password by email? )

Breaches, Phishing, It doesn't matter ... DO NOT RE-USE PASSWORDS!

At Malcovery Security we specialize in email-based Threat Intelligence. Part of that practice is having an enormous database of spam and phishing information, including nearly 700,000 confirmed phishing websites and information about each of those threats. Many of the malware samples that we report on daily through our "Today's Top Threats" report will also steal userids and passwords to accounts, including your email accounts. Almost every version of Zeus will do so, as one example. Here are a few of the Yahoo-targeted phishing scams that were popular during the previous week:

• BT Internet Phish:

  

  In this long-running phishing campaign, users of Yahoo's "BTInternet.com" email domain are told that BT Broadband (formerly British Telecom) is discontinuing their email account and will replace it with a Premium Email account that they have to pay for, unless they confirm they want to keep the account by entering their email userid and password to prove they are really in control of the account.

  (This phishing screenshot was captured by Malcovery January 23, 2014 from dtinternet[.]bug3[.]com)

• Google Docs Phish:

  

  Although this phish claims to be from Google Docs, this scam campaign began its life as a ReMax realty phish. In order to confirm your identity, you are asked to provide the userid and password of whichever popular email service you are using. From there the threats are similar to those described above.

  (This phishing screenshot was captured by Malcovery January 29, 2014 from www[.]thewigleygroup[.]com/googledocss/sss/)

• GT Bank / Yahoo! Phish:

  

  GT Bank is Guaranty Trust Bank plc, a pan-African bank with Nigerian roots. In this example, the phishing target is actually Yahoo, but since the phish was created by someone logging in from Africa, the Yahoo! page they captured is adorned with a GTBank logo and advertisement.

  (This particular phishing screenshot was captured by Malcovery January 22, 2014 from highbeam[.]co[.]th/eart/Indezx.html)

Yahoo Malware, additional data based on Fox-IT report

This weekend on the news, or perhaps Monday morning on NPR, you heard that the popular Yahoo domain has been targeted by criminals who pushed malicious advertisements through their services to unsuspecting victims. This technique, generally known as "malvertising", works because advertisement hosters, such as Yahoo, Microsoft, and Google, run deep networks of ads that pull in third party content, which can itself pull in third party content, through many links down an increasingly untrustworthy and untraceable chain. This is nothing new, but is still concerning after at least five years worth of investigations into how to protect ad networks better.

The famous "DNS Changer" case that was featured on the FBI's website in the story Case against Internet fraud ring reveals millions unknowingly affected worldwide actually began when criminals were using such malicious ads to push Fake Antivirus malware to a variety of high profile websites, including the New York Times, which explained its own breach in this September 2009 story, Advertising - On the Web, Ads Can Be a Security Hole.

In the current Yahoo campaign, it was the excellent researchers at Fox-IT in the Netherlands who broke the news. Their story, Malicious advertisements served via Yahoo showed some key information about what was going on.

One very important difference between what you are hearing on the news and reality ... NO ONE HAD TO CLICK the ads in order to be infected. Because the ads displayed an "IFRAME" which caused a REDIRECT to be executed, simply having the ad displayed in your JavaScript aware browser was enough to cause the Exploit Kit to be visited. Over 300,000 computers per hour were visiting the Exploit kit, and roughly 11% of them, 27,000 per hour, were actually infected with malware as a result of the visit. These are very acceptable numbers in the malware distribution world. (visit and infection rates based on Fox-IT's analysis of the destination server hosted in the Netherlands.)

Basically, some of the advertisements that appeared through Yahoo's ad network contained an IFRAME. An IFRAME is an HTML command that says "go get some content from this OTHER website, and display it as part of what is being shown here." According to Fox's article, some of the domains where the IFRAMEs were hosted included:

• blistartoncom.org (192.133.137.59), registered on 1 Jan 2014
• slaponitkons.net (192.133.137.100), registered on 1 Jan 2014
• origina-filmsonline.com (192.133.137.63)
• funnyboobsonline.org (192.133.137.247)
• yagerass.org (192.133.137.56)

Magnitude Exploit Kit

Their article also says that the IFRAME would redirect the computer to a copy of an Exploit Kit known as "Magnitude" by issuing an HTTP REDIRECT statement. You may be familiar with the most famous Exploit Kit in history, the Blackhole Exploit Kit. Back in December this blog ran a story Paunch and the Black Hole / Cool EK Exploit Kit that discussed the fact that the criminals behind that kit have finally been apprehended, and that since their arrest in October, there had been a marked decline in Exploit Kit-based infections.

During my "Malcovery Security Year in Review 2013" webinar (recording available here), one of my predictions was "Prediction #6: Malicious Email Innovators will expand into the vaccum left by Black Hole Exploit arrests". We'll be watching the Magnitude Exploit Kit to see if it can rise to that level.

One reason to believe that Magnitude may dominate this space is to look at where known cybercriminals moved their goods after the demise of BlackHole Exploit Kit. BlackHole was actually one of TWO Exploit Kits run by Paunch. The "premium" Exploit Kit was called "Cool EK" and delivered zero-day (0-day) exploits that were not publicly available anywhere else. After the zero-days became publicly disclosed, Paunch would push those exploits to the lower cost and more common BlackHole Exploit Kit. The primary buyers of the Cool EK throughout the summer were the criminals behind Reveton, which was also known as "Police Lock Ransomware".

One of the early uses of the Magnitude EK was disclosed on the website "kahusecurity", in their article Deobfuscating Magnitude Exploit Kit. The analysis shows that Magnitude was pushing very new Zero-day exploits, and more interestingly, the end-game of the infection was to install the Reveton PoliceLock Exploit Kit!

(Click image to visit the KahuSecurity report on Magnitude EK)

This is also not the first time that the Magnitude Exploit Kit has been associated with a high-profile website "drive-by infection". Our friend Fabio Assolini, of Kaspersky Security, confirmed that PHP.net, the official website of PHP, was actually injected with a malicious iframe that pointed to the Magnitude Exploit Kit and infected visitors with the Tepfer Trojan (which is better known in some circles as Papras). Here's his tweet (thanks to KahuSecurity for the link):

Other great analysis links for understanding Magnitude EK include:

• Kaffeine's blog "MalwareDon'tNeedCoffee" -- Magnitude EK: Pop! Pop! (March 2013! Kaffeine ahead of us all!)
• Dell SecureWorks's blog -- Cutwail Spam Swapping Blackhole for Magnitude
• ProofPoint's ThreatInsight post -- Paunch Arrest May Mean Magnitude Exploit Kit is the New Blackhole

Magnitude used in ADP Spam

We certainly agree with ProofPoint and Dell on their assertion that Cutwail is using Magnitude. While Reveton was a primary user of the Cool EK, the heaviest user of the BlackHole EK were the malware spammers behind Cutwail. One example of Cutwail using Magnitude would be the October 22, 2013 ADP Payroll spam campaign. In that campaign, Malcovery's T3 Report customers would have been warned of spam messages with subjects "ADP payroll: Account Charge Alert" and "ADP RUN: Account Charge Alert" where URLs on compromised WordPress sites, including cinematracks.com, campwow.com, ceo-interviews.com, and businessblogtechs.com were being used to send visitors to the Magnitude EK site abrakandabr.ru to retrieve "adp.report.php" from port 8080. Just as in this weekend's Yahoo exploit, the primary infection method was a hostile ".jar" file dropped from the Exploit Kit. On October 22, 2013, the ADP spam campaign's Magnitude server dropped the jar file we reported to VirusTotal in this report. which when last scanned was detected as hostile by 6 of 47 Antivirus vendors.

Check Your Logs for . . .

Fox-IT lists that there were several "seemingly random subdomains" on the following domains that were used in the redirection, which they list as:

• boxsdiscussing.net
• crisisreverse.net
• limitingbeyond.net
• and others

Based on some research that I've done in the Internet Identity Passive DNS Research platform, I was able to find those names ... here are some examples:

201214.yqs.lucd.ici.ptwd.ivntyzjdlzuk.boxsdiscussing.net
201211.ef.ivntyzjdlzuk.boxsdiscussing.net
201116.vbnf.mkr.ovei.zza.cgu.ivntyzjdlzuk.boxsdiscussing.net
201214.rcfg.bgy.tej.veae.juv.ivntyzjdlzuk.boxsdiscussing.net
201311.leo.dx.ivntyzjdlzuk.boxsdiscussing.net
201115.fe.srqe.sbisakxivel.boxsdiscussing.net
2018.xfi.eah.mhi.sbisakxivel.boxsdiscussing.net
201311.zn.sbisakxivel.boxsdiscussing.net
201216.ehp.sbisakxivel.boxsdiscussing.net
201216.rmji.kjm.hrp.xpex.sbisakxivel.boxsdiscussing.net
201115.obw.wx.sbisakxivel.boxsdiscussing.net
201116.bomw.tswi.vpzy.ir.kqdy.sbisakxivel.boxsdiscussing.net

201311.qw.wvtj.cb.eveourvczt.crisisreverse.net
201311.hrph.sqee.zo.eveourvczt.crisisreverse.net
201118.bfcq.eveourvczt.crisisreverse.net
201116.sp.xdq.xwgt.vqna.ms.eveourvczt.crisisreverse.net
201311.zjn.ejh.rws.hwhd.twiurmgmvw.crisisreverse.net
201116.zllf.zj.lbz.be.twiurmgmvw.crisisreverse.net
201216.udi.wke.twiurmgmvw.crisisreverse.net
201311.nez.uj.kbwc.atk.pbgu.twiurmgmvw.crisisreverse.net
201214.quqc.gm.rf.we.tg.fmpryuyqoz.crisisreverse.net
201311.mak.fmpryuyqoz.crisisreverse.net
201311.nsm.fmpryuyqoz.crisisreverse.net
201311.zm.fmpryuyqoz.crisisreverse.net
201115.ysw.fmpryuyqoz.crisisreverse.net

201115.eoju.zqlj.ze.tt.cmxf.paftwtdqc.limitingbeyond.net
201116.pg.paftwtdqc.limitingbeyond.net
201115.pz.rbnq.rwg.paftwtdqc.limitingbeyond.net
201210.xm.sym.paftwtdqc.limitingbeyond.net
201111.bao.paftwtdqc.limitingbeyond.net
201116.wi.tdc.xgx.jfuo.paftwtdqc.limitingbeyond.net
201514.pbcp.paftwtdqc.limitingbeyond.net
201214.aeo.nwfn.cbpz.efs.paftwtdqc.limitingbeyond.net
201216.yjg.ynnu.paftwtdqc.limitingbeyond.net
201210.yu.paftwtdqc.limitingbeyond.net
201116.jy.ek.tma.fuiv.paftwtdqc.limitingbeyond.net
201116.fo.hea.dyu.wqi.cnsw.paftwtdqc.limitingbeyond.net
201514.fwsj.qygk.dmd.bia.vhy.paftwtdqc.limitingbeyond.net
201214.nsnz.paftwtdqc.limitingbeyond.net

In addition to the domains listed by Fox-IT, we were able to confirm these additional domains, which all used the same hostname/subdomain patterns, and all resolved to the same IP address, 193.169.245.78.

• boxsdiscussing.net
• chapterwild.net
• crisisreverse.net
• elsecommenting.net
• farmtrains.net
• federalpoet.net
• irritatedpound.net
• layfriend.net
• liechecks.net
• limitingbeyond.net
• suggestsfilm.net

One example of each of those hostname/subdomain patterns for each of those domains, all observed in the IID Passive DNS collection resolving to 193.169.245.78, are given here:

• 201311.koha.uue.vwm.swp.cfmg.buosehgr.boxsdiscussing.net
• 201311.et.ck.fsc.gjwa.dh.acirtcbrjmcm.chapterwild.net
• 201116.sp.xdq.xwgt.vqna.ms.eveourvczt.crisisreverse.net
• 201214.ups.xwo.jrw.hoy.bmm.bhzoahcvhbv.elsecommenting.net
• 201210.kyy.qfw.qji.lg.agw.douvcaghuuh.farmtrains.net
• 201214.lu.oqkt.vu.qfmw.xsyn.gjsjixxiskxe.federalpoet.net
• 201116.ivfi.pmar.vv.hw.fvyg.aicnkapom.irritatedpound.net
• 201116.gp.hnpd.lwp.nv.aj.armlnjjyot.layfriend.net
• 201210.uzb.cavs.bqkw.kpou.cwp.blenzspz.liechecks.net
• 201210.bigc.opt.jcov.widl.hpv.duohlqzrzqw.limitingbeyond.net
• 201116.jjia.wo.nmf.chl.sog.gvkqjqvzf.suggestsfilm.net

Fox-IT illustrates the Infection Flow

Please visit the excellent post by Fox-IT to read their analysis, but I've borrowed their graphic from there as a better way to show the traffic flow.
(click graphic to visit original article)