Saturday, March 2, 2024

RedThief Hacker Group Targeting Students in The U.K. to Steal Financial Data

In an activity dubbed RedThief (aka RedZei), Chinese-speaking scammers have been targeting Chinese international students in the UK for more than a year.

There have been numerous reports of scammers calling from a UK phone number once or twice a month leaving a voicemail that is unusual for an automated voicemail and often leaving only one or two messages.

Threat actors use this as one of their main modes of operation. Apart from this here’s what Will Thomas (@BushidoToken), a cybersecurity researcher stated:-

“A rich victim group that is ripe for exploitation is precisely what RedZei fraudsters used as their targets after careful research and careful selection.”

Aspect and Malicious Tradecrafts of the Operation

There is one remarkable characteristic of this operation, and that is how the threat actors were able to circumvent the steps that users had taken to prevent scam calls.

They do so by preventing the use of a phone number-based blocking system with help of pay-as-you-go UK phone numbers for each wave.

An attacker in this scenario switches between SIM cards from several mobile carriers, including the following ones:-

  • Three
  • O2
  • EE
  • Tesco Mobile
  • Telia

The main purpose of voicemails is to social engineer students into sharing personal information by impersonating companies such as:-

  • Bank of China
  • China Mobile
  • Chinese embassy

“RedZei gang includes leveraging Chinese enterprises, such as the Bank of China or China Mobile (CMLink) to social engineer the international students into providing their personal details.”

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book


Latest articles

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles