INTERPOL and several partners recently worked together to dismantle a global phishing-as-a-service (PaaS) operation.This work led to the arrest of the suspected administrator of PaaS platform 16shop and two other suspects in Indonesia and Japan in July 2023, INTERPOL said in a prepared statement.Along with Trend Micro, the INTERPOL General Secretariat's cybercrime directorate, national law enforcement in Indonesia, Japan and the United States and the Cyber Defense Institute, Group-IB, Palo Alto Networks Unit 42 and Cybertoolbelt shared threat intelligence that led to the three arrests in July 2023.INTERPOL's cybercrime directorate encourages cyber experts from around the world to gather and analyze information on criminal activities, the agency noted. These experts can then generate intelligence that they can use to find ways to keep pace with current and emerging cyber threats.
What is 16shop?
16shop is a PaaS platform launched in 2018 that sold "phishing kits" to hackers that wanted to defraud internet users through email scams, INTERPOL indicated.With these scams, victims would receive an email with a PDF file or link that redirects them to a site requesting their credit card or other personally identifiable information, INTERPOL noted. At this point, their information is stolen and used to extract money from the victims.In total, 16shop is estimated to have enabled phishing attacks on more than 70,000 victims in 43 countries, INTERPOL said. 16shop was active until 2021, with copycat sites likely launched after this date.INTERPOL Seeks Cybersecurity Community's Help
Analysts in INTERPOL's cybercrime division flagged 16shop during a project researching cyber threats in the Association of Southeast Asian Nations (ASEAN) region, the agency said. From here, INTERPOL used information from several private-sector partners to determine the identity and probable location of the platform's administrator. It also discovered that 16shop was registered in Indonesia, and its servers were hosted in the United States.INTERPOL requested information from Trend Micro about 16shop, the company said. At this point, Trend Micro investigated the PaaS platform and found that:- Attacks supported by 16shop were taking place in the United States, Japan and Germany.
- 16shop customers were able to craft phishing pages to harvest Amazon, American Express, PayPal, Apple and CashApp credentials and U.S. banking logins.
- 16shop's phishing kits automatically localized the language of phishing sites based on a victim's location.
- 16shop offered anti-sandboxing, geolocated access restrictions and other capabilities designed to help users bypass security tools and analysis.
- 16shop's web infrastructure was hosted across several cloud providers to avoid detection.
