Forex Broker Impersonation Campaign
Single threat actor operating 12 impersonation channels targeting a regulated forex broker, averaging 47 new victims per week before intervention.
Threat Landscape
A single threat actor had established 12 Telegram channels impersonating a regulated EU forex broker. Each channel used official branding assets scraped from the broker's website and featured fake 'account managers' offering leveraged trading signals. Victims were funneled through a Telegram bot that requested wallet deposits for 'margin requirements.' The actor used disposable SIM cards and Fragment-purchased Telegram accounts, rotating channels every 72 hours to evade automated detection.
Engagement Timeline
Day 1
Network Discovery
Used username variant scanning (Levenshtein distance) to discover all 12 active clone channels. Tagged 3 historical channels that had been deleted.
Day 2-4
Attribution & Tracing
Traced deposit wallet addresses on-chain. Identified 2 connected TON wallets with transaction history linking to known scam clusters. Discovered public Telegram group where actor recruited channel members.
Day 5-7
Takedown & Disruption
Initiated parallel takedown across all 12 channels. Submitted wallet addresses to blockchain analytics platforms for blacklisting. Disrupted recruitment operations via group infiltration.
Day 8-10
Monitoring
Post-takedown monitoring detected 2 additional channels created by the same actor within 48 hours. Both were neutralized within 6 hours of creation.
Tactics Used
Results
Back to Case Studies