Citigroup, Idaho, and Build-A-Bear Networks Used in Coordinated Phone Fraud Attack

Coordinated Phone Fraud Incident

On August 1st, networks associated with Citigroup, the State of Idaho, Build-A-Bear, Lockheed Martin, the Spanish National Police, and several other entities engaged in a coordinated International Revenue Share Fraud (IRSF) scheme. Over 27 hours, these networks made attempts to use a VoIP (SIP) server to place calls to international premium-rate numbers. The objective of IRSF is for attackers to profit from a share of the revenue generated by these calls.

Evidence of Coordination

The attacks demonstrated coordination, as all participating networks attempted to dial the same phone number and spoofed an identical small set of fake caller IDs. These patterns were observed across servers in Los Angeles, New York, and Tokyo, indicating that the bots were receiving instructions from a central command rather than acting independently. This suggests a botnet operation rather than isolated incidents.

Compromised Networks

The organizations involved were not complicit; rather, their networks were likely compromised. The most probable cause is an employee clicking a malicious link or introducing an infected device, leading to a bot establishing a presence within the corporate or government network. This bot then attempts to dial out to a fraud ring, and potentially has access to other resources within the compromised network.

Honeypot Detection and Implications

The targeted SIP server functions as a honeypot, which has recorded over 11.5 million protocol attacks. While no harm was done to the honeypot operator, the incident underscores a significant security concern for the affected organizations. The presence of a rogue machine within their network indicates a vulnerability that could extend beyond phone fraud to other forms of data exfiltration or system compromise. Tools are available to help organizations identify if their networks were involved in these recorded attacks.