RedThief Hacker Group Targeting Students in The U.K. to Steal Financial Data

In an activity dubbed RedThief (aka RedZei), Chinese-speaking scammers have been targeting Chinese international students in the UK for more than a year.

There have been numerous reports of scammers calling from a UK phone number once or twice a month leaving a voicemail that is unusual for an automated voicemail and often leaving only one or two messages.

Threat actors use this as one of their main modes of operation. Apart from this here’s what Will Thomas (@BushidoToken), a cybersecurity researcher stated:-

“A rich victim group that is ripe for exploitation is precisely what RedZei fraudsters used as their targets after careful research and careful selection.”

Aspect and Malicious Tradecrafts of the Operation

There is one remarkable characteristic of this operation, and that is how the threat actors were able to circumvent the steps that users had taken to prevent scam calls.

They do so by preventing the use of a phone number-based blocking system with help of pay-as-you-go UK phone numbers for each wave.

An attacker in this scenario switches between SIM cards from several mobile carriers, including the following ones:-

• Three
• O2
• EE
• Tesco Mobile
• Telia

The main purpose of voicemails is to social engineer students into sharing personal information by impersonating companies such as:-

• Bank of China
• China Mobile
• Chinese embassy

“RedZei gang includes leveraging Chinese enterprises, such as the Bank of China or China Mobile (CMLink) to social engineer the international students into providing their personal details.”

Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book