Cybercriminals are activity performing SIM swap Attack in various countries to bypass 2 Factor Authentication and to compromise the various social media apps including WhatsApp by porting a victims telephone number to a new SIM card.
This widespread attack causing the financial damages, steal credentials and capture OTPs to bypass victims online accounts.
There are various fraud centers and thousands of operators are working around the world to seamlessly port a telephone number to a new SIM with high success ratio.
In this case, Countries like Brazil and Mozambique having a high rate of SIM swap frauds using various social engineering techniques, phishing attack.
Successful attempts of this attack let fraudsters take control of customers’ phone numbers in order to receive mobile money transactions or to collect the home banking OTPs to complete a transfer of funds or steal users’ money.
Fraudulent actors often targeting high profiles including politicians, ministers, governors and businessmen using SIM Swap Attack to access their sensitive online accounts even bank transactions.
An organized gang alone in Brazil was able to SIM swap 5,000 victims and also stolen more than US$50,000 from Businessman’s bank account.
How does this Organised cybercrime works
Cyber crooks initially collecting various information from victims using phishing attacks, buying information from Undergrounds markets, obtain information from data breaches.
Later they will execute a well-planned operation to convince the telephone company to port the victim’s phone number to the fraudster’s SIM by impersonating the victim and claiming they have lost their phone and change number into new SIM card.
Soon after this successful activation, targeted victims will lose the connection and the new network connection will be allocated into the fraudster SIM card.
“This could allow intercepting any one-time passwords sent via SMS or telephone calls made to the victim; all the services that rely on an SMS or telephone call authentication can then be used “
According to Kaspersky research, “We have found that some of the processes used by mobile operators are weak and leave customers open to SIM swap attacks. For example, in some markets in order to validate your identity, the operator may ask for some basic information such as full name, date of birth, the amount of the last top-up voucher, the last five numbers called, etc. Fraudsters can find some of this information on social media or by using apps such as TrueCaller to get the caller name based on the number. “
Some times these attacks are executing via insider threats, cyber criminals paying nearly $15 to $20 to the ISP breach operators for activation process.
Price for SIM swap
There are many Brazilian underground markets operating for this SIM swap process and they demand the different price based on the targets.
for example, a SIM swap for a famous celebrity or a politician can cost thousands of dollars and also it advertise in closed Facebook community. the following price is stats in Bazilian underground market.
Cloning the Social Media Apps Like WhatsApp
An Attack called Whatsapp cloning let criminal to load WhatsApp and all the victim’s chats and contacts after a SIM swap.
Later they Start the conversation to the WhatsApp contact and citing an emergency and asking for money.
In some cases, criminals using this SIM Swap attack to feign a kidnapping situation, asking for an urgent payment.
“Some of the attacks targeted companies, with executives supposedly contacting their financial departments asking for funds, when in fact it was fraudsters using WhatsApp accounts hijacked in a SIM swap “