Uncovering Actor TTP Patterns and the Role of DNS in Investment Scams
Essential information
- Published
- 06/05/2025 15:50
- Modified
- 06/05/2025 20:16
- Tags
- 2025-04-29 2025-05-06 cloaking cryptocurrency dns abuse dns exploitation facebook ads investment scams rdga registered domain generation algorithms social engineering tds web forms
- Related entities
- 87 observables, 9 techniques (mitre), 6 others
Description
This report analyzes common techniques, tactics, and procedures (TTPs) used by several investment scam actors who lure victims with fake platforms, including crypto exchanges. Key TTPs include registering large numbers of domains algorithmically, embedding similar web forms to collect user data, hiding activity through traffic distribution systems, leveraging fake news with celebrity endorsements, and sharing website structures indicative of using kits. The report focuses on two notable actors, Reckless Rabbit and Ruthless Rabbit, detailing their distinct characteristics and DNS exploitation methods. It highlights the importance of DNS in building and maintaining scam infrastructure, emphasizing the use of registered domain generation algorithms (RDGAs) and traffic distribution systems (TDSs) to strengthen resilience and evade detection.