Sophos unravels 20 fake criminal marketplaces designed to scam scammers

SOPHOS, a global leader in innovating and delivering cybersecurity as a service, recently revealed details of how it tracked down the likely culprit behind more than 20 fake criminal marketplaces designed to con cyber scammers in part three of Sophos’ “The Scammers Who Scam Scammers on Cybercrime Forums” series.

After stumbling upon a surface website mimicking the real criminal underground site Genesis, Sophos researchers further uncovered the 20 fake marketplaces dating back to August 2021. All of the fake sites appeared to be run by a scammer who uses the handle “waltcranston,” a likely riff on the television show “Breaking Bad.”

“While investigating this huge subeconomy of scammers scamming other scammers, we examined about 600 scams of varying types. Out of all the scams investigated, this operation stood out for its sheer scope and intricacy. The scammer advertises the fake marketplaces on Reddit and replicates not just Genesis, which was the first scam site we ran across, but numerous other prominent or defunct marketplaces, such as Benumb, UniCC and PoisOn. While at a technical level, these scam sites are not sophisticated, the scam operation has been highly successful. Seven of these fake sites are still active, and, to date, the cryptocurrency wallets associated with the scams have received at least $132,000,” said Matt Wixey, senior threat researcher, at Sophos.

All 20 of the fake sites followed a similar scheme. Criminals were offered a chance to activate an account on the fraudulent version of a dark web marketplace with $100. The criminals expected their $100 would be deposited in either Bitcoin or Monero, and they would receive activation credentials. However, as part of the scam, once the criminals paid, their accounts would never activate.