In a tech support scam (TSS), cybercriminals impersonate legitimate service providers by mimicking the interactions consumers routinely have with companies. We conduct a comprehensive analysis of the supply side of the TSS ecosystem on Facebook, where groups operate as informal marketplaces that lack traditional trust or reputation metrics. The study utilizes an AI-driven technique to classify posts into different categories, based on labels derived from manual classification, using Gemma original and Gemma-3-12B large language models. In total, we categorized 381,843 posts across 96 groups made between April 2015 and March 2024. The results highlight different user types and their characteristics. We analyze the resulting posts to shed light on the various types of products and services offered by the groups. We also investigate the extent of specialization and generalization among cybercriminal participants. It is hoped that the detailed study on such ecosystems can aid law enforcement and policy efforts to identify suitable intervention points and effective countermeasures against the TSS ecosystem.

Rising incidences of paper check fraud, particularly with checks illicitly sold on platforms such as Telegram, pose significant challenges in financial security. Despite investigators' capability to gain access to these platforms, manually pinpointing checks in images and extracting necessary details to alert banks are inefficient and unscalable. Traditional optical character recognition-based (OCR) systems for extracting textual details from checks specifically struggle with handwritten content and are constrained by their dependency on predefined check layouts, limiting their effectiveness across varied and evolving check designs. To address these challenges, we introduce GenCheck, a generative AI-based framework that automates both the check detection and accurate extraction of check information, ensuring robust performance across various check layouts or styles. GenCheck operates through a two-stage pipeline: the preliminary stage encompasses multiple sub-tasks including check image classification, single check segmentation, image rectification, and check element detection, while the main stage focuses on the key task of check information extraction. Central to our pipeline is the strategic enhancement of a state-of-the-art (SOTA) multimodal large language model (LLaVA-NeXT) using Low-Rank Adaptation (LoRA). This fine-tuning leverages the model's pre-trained knowledge, applying a targeted, parameter-efficient approach that significantly enhances its ability to accurately extract key details such as dates, amounts, and payee information from paper check images. Our framework achieves exceptional accuracy rates in extracting date information with 92.07 % for year, 85.16% for month, and 82.72% for day. It also obtains an accuracy of 80.61 % in extracting monetary amounts and a normalized edit distance of 0.2583 for payee information, demonstrating substantial improvements over pure OCR-based methods. As the first framework of its kind, GenCheck estab-lishes a methodological base that supports continuous innovation and enhancement, allowing for independent updates of each component model. This also sets a new standard in automated check analysis, reducing the need for labor-intensive, rule-based processes and significantly advancing fraud prevention initiatives.

The prevalence of check fraud, particularly with stolen checks sold on platforms such as Telegram, creates significant challenges for both individuals and financial institutions. This underscores the urgent need for innovative solutions to detecting and preventing such fraud on social media platforms. While deep learning techniques show great promise in detecting objects and extracting information from images, their effectiveness in addressing check fraud is hindered by the lack of comprehensive, open-source, large training datasets specifically for check information extraction. To bridge this gap, this paper introduces "CheckGuard," a large labeled image-to-text cross-modal dataset designed for check information extraction. CheckGuard comprises over 7,000 real-world stolen check image segments from more than 15 financial institutions, featuring a variety of check styles and layouts. These segments have been manually labeled, resulting in over 50,000 samples across seven key elements: Drawer, Payee, Amount, Date, Drawee, Routing Number, and Check Number. This dataset supports various tasks such as visual question answering (VQA) on checks and check image captioning. Our paper details the rigorous data collecting, cleaning, and annotation processes that make CheckGuard a valuable resource for researchers in check fraud detection, machine learning, and multimodal large language models (MLLMs). We not only benchmark state-of-the-art (SOTA) methods on this dataset to assess their performance but also explore potential enhancements. Our application of parameter-efficient fine-tuning (PEFT) techniques on the SOTA MLLMs demonstrates significant performance improvements, providing valuable insights and practical approaches for enhancing model efficacy on this task. As an evolving project, CheckGuard will continue to be updated with new data, enhancing its utility and driving further advancements in the field. Our PEFT-based MLLM code is available at: https://github.com/feizhao19/CheckGuard. For data access, researchers are required to contact the authors directly.

There are many variants of different malware (malicious software) like trojans, adware, keylogger, worms, and others, but ransomware is the most catastrophic among them.Ransomware is the type that encrypts the user file system and seeks compensation in return to make it usable again.Ransomware has been evolving at a massive pace and reached an all-time high, with 552 variants recorded in the year 2017 and 352 variants in 2018.In comparison to the prior years, the number was significantly higher than the combination of all the previous years.The primary reason for this massive shift is the ease of production of new ransomware variants as well as ransomware being used as a service.The paper highlights a worrying state for the current safeguard measures of the anti-virus industry, a significant majority, more than 50% of ransomware samples produced in both the years are actively encrypting the users' machine.Despite the advancement and regular monitoring of the antivirus industry, the ransomware problem remains a significant issue.The concern is not only for the industry but also for the end-user as the new variants are being produced regularly, and old variants are not being eliminated.The following paper tries to raise awareness among the community about the increasing ransomware problem and the importance of taking proper preventive measures to safeguard against the rising attacks.

Internet Control Message Protocol Time-Exceeded (ICMP-TE) time exceeded packets are particular communication protocols to express inaccessibility of nodes in terms of hop count limitations. With the Internet of Things (IoT) concept taking more space in our daily life, accessibility or in some manners inaccessibility of hosts should be analysed more carefully. ICMP time exceeded packets might be hand of an attacker, sometimes an indicator of compromise for a possible IoT Botnet attack or a tool for delay measurement. In this study, with the exploitation of ICMP time exceeded packets, we analyse Round Trip Time (RTT) delays of randomly distributed IP routers around the globe. We conduct a comprehensive delay analysis study considering the delay results of more than 1 million time exceeded packets taken in return for subject ICMP requests. To prove ICMP time exceeded packets might also be a signature for a possible IoT Botnet attack, we carry out a secure experiment for Mirai IoT Botnet scanning and exhibit the indicators to differentiate these two possible usages.

Nowadays, online banking is an attractive way of carrying out financial operations such as ecommerce, e-banking, and e-payments without much effort or the need of any physical presence. This increasing popularity in online banking services and payment systems has created motivation for financial attackers to steal customer`s credentials and money. Banking trojans have been a way of committing attacks on these financial institutions for more than a decade, and they have become one of the primary drivers of botnet traffic. However, the stealthy nature of financial botnets requires new techniques and novel systems for detection and analysis in order to prevent losses and to ultimately take the botnets down. TrickBot, which specifically threatens businesses in the financial sector and their customers, has been behind man-in-the-browser attacks since 2016. Its main goal is to steal online banking information from victims when they visit their banking websites. In this study, we utilize machine learning techniques to detect TrickBot malware infections and to identify TrickBot related traffic flows without having to analyze network packet payloads, the IP addresses, port numbers and protocol information. Since command and control server IPs are updated almost daily, identification of TrickBot related traffic flows without looking at specific IP addresses is significant. We adopt behavior-based classification that uses artifacts created by the malware during the dynamic analysis of TrickBot malware samples. We compare the performance results of four different state-of-the-art machine learning algorithms, Random Forest, Sequential Minimal Optimization, Multilayer Perceptron, and Logistic Model to identify TrickBot related flows and detect a TrickBot infection. Then, we optimize the proposed classifier via exploring the best hyperparameter and feature set selection. Looking at network packet identifiers such as packet length, packet and flag counts, and inter-arrival times, the Random Forest classifier identifies TrickBot related flows with 99.9534% accuracy, 91.7% true positive rate.

Phishing attacks are becoming increasingly prevalent: 2016 saw more phishing attacks than any previous year on record according to the Anti-Phishing Working Group. At the same time, the growing level of sophistication of cybercriminals must be understood for the development of effective anti-phishing systems, as phishers have extensive control over the content they serve to their victims. By examining two large, real-world datasets of phishing kits and URLs from 2016 through mid-2017, we paint a clear picture of today's anti-phishing ecosystem while inferring the higher-level motives and thought processes of phishers. We analyze the nature of server-side .htaccess filtering techniques used by phishers to evade detection by the security community. We also propose a new generic classification scheme for phishing URLs which corresponds to modern social engineering techniques and reveals a correlation between URL type and compromised infrastructure use. Our analysis identifies measures that can be taken by the security community to defeat phishers' countermeasures and increase the likelihood of a timely response to phishing. We discover that phishers have a keen awareness of the infrastructure used against them, which illustrates the ever-evolving struggle between cybercriminals and security researchers and motivates future work to positively impact online security.

Malicious software, universally known as malware, is typically used to cause disruption as it tries to steal sensitive information such as passwords, credit card numbers and other pertinent information. Malware infections have increased tremendously over the last decade. Recent reports indicate that around 70% of malware infections go undetected by the antivirus software. The infections that remain undetected fall into the category of zero-day malware, which is defined as malware that is new and is essentially an undiscovered and undisclosed threat. Furthermore, its substructure or the functioning has not been understood, and no signatures have been defined to distinguish the zero-day malware from others. Moreover, an average enterprise receives 17,000 malware alerts per week, and if 70% goes undetected, then one is certain to be infected by the zero-day malware every week. Therefore, the low detection rates and increasing vulnerabilities have created an unmet need for the researchers to try and develop an algorithm that will help in timely and efficient detection of malware. Moreover, in our approach researchers used the cloud for malware detection, which is a safe, cost-effective and user-friendly environment.

Retrieval of images with object-of-interest from a vast pool of social media images has been a research interest in cyber crime research community for detecting criminal behaviors in social media. Due to inherent diversity and the low duplicate property of images on social media, it brings forth many challenges in image retrieval, especially in identifying distinct features for a given object-of-interest. Previous literature approached this problem with extended General Hough Transform, where Hough space is analyzed for each specific object-of-interest. Different objects of interest produce different types of patterns in Hough space and no unified framework can be easily established to incorporate all those patterns. In this paper, we propose a unified framework based on convolutional neural network (CNN) for classifying the social media images and retrieving the images based on the probability score from the softmax classifier. In our framework, a reduced size CNN model is trained by distilling the knowledge from a pretrained full size CNN model, which is suitable for applications with limited training data such as ours and results in a higher accuracy in image retrieval as well as better performance in execution speed in comparison with the full size CNN model. Experiments on three image datasets relating to suspicious e-crime and terrorist involvement - Guy Fawkes masks, credit card logos, and ISIS logos show that our framework outperforms extended General Hough Transform and the full size CNN model.

Using object-of-interest matching to detect presence of e-Crime activities in low-duplicate social media images is an interesting yet challenging problem that involves many complications due to the dataset's inherent diversity. SURF-based (Speeded Up Robust Features) object matching, though claimed to be scale and rotation invariant, is not effective as expected in this domain. This paper approaches this problem by an extended paradigm of Generalized Hough Transform using shape matching applied to two types of object-of-interest, Guy Fawkes Mask and Credit Card. We propose an extended GHT that updates the best matching score and the sum up score simultaneously, combined with a face detector and circular magnitude ranker, for detecting Guy Fawkes; also proposed is an extended GHT capable of mining the directional property in Hough space, combined with optical character recognition and an edge density filter, for detecting credit cards. Experiments on two real world datasets indicate that our approach outperforms the baseline GHT and the SURF.

Phishing websites, phish, attempt to deceive users into exposing their passwords, user IDs, and other sensitive information by imitating legitimate websites, such as banks, product vendors, and service providers. Phishing investigators need fast automated tools to analyze the volume of phishing attacks seen today. In this paper, we present the Simple Set Comparison tool. The Simple Set Comparison tool is a fast automated tool that groups phish by imitated brand allowing phishing investigators to quickly identify and focus on phish targeting a particular brand. The Simple Set Comparison tool is evaluated against a traditional clustering algorithm over a month's worth of phishing data, 19,825 confirmed phish. The results show clusters of comparable quality, but created more than 37 times faster than the traditional clustering algorithm.

Spam researchers and security personnel require a method for determining whether the URLs embedded in email messages are safe or potentially hostile. Prior research has been focused on spam collections that are quite insignificant compared to real-world spam volumes. In this paper, researchers evaluate 464 million URLs representing nearly 1 million unique domains observed in email messages in a six day period from November 2014. Four methods of customization and randomization of URLs believed to be used by spammers to attempt to increase deliverability of their URLs are explored: domain diversity, hostname wild-carding, path uniqueness, and attribute uniqueness. Implications of the findings suggest improvements for ???URL blacklist??? methods, methods of sampling to decrease the number of URLs that must be reviewed for safety, as well as presenting some challenges to the ICANN, Registrar, and Email Safety communities.

The 2014 Digital Forensics Research Experience for Undergraduates (REU) Program at the University of Alabama at Birmingham (UAB) focused its summer efforts on tracking criminal forums and Facebook groups. The UAB-REU Facebook team was provided with a list of about 60 known criminal groups on Facebook, with a goal to track illegal information posted in these groups and ultimately store the information in a searchable database for use by digital forensic analysts. Over the course of about eight weeks, the UAB-REU Facebook team created a database with over 400 Facebook groups conducting criminal activity along with over 100,000 unique users within these groups. As of November 2014, students involved in the research project with Advisor Gary Warner at UAB continued running the automated fetchers since my summer projected completed. Working with U.S. Federal Law Enforcement agencies, there have been at least NINE CONFIRMED ARRESTS of individuals associated with the illegal activities tracked on Facebook. This paper will discuss the methods used to collect the information, store it in a database and analyze the data. The paper will also present possible future uses of the Facebook criminal activity-monitoring tool.

Spam researchers and security personnel require a method for determining whether the URLs embedded in email messages are safe or potentially hostile. Prior research has been focused on spam collections that are quite insignificant compared to real-world spam volumes. In this paper, researchers evaluate 464 million URLs representing nearly 1 million unique domains observed in email messages in a six day period from November 2014. Four methods of customization and randomization of URLs believed to be used by spammers to attempt to increase deliverability of their URLs are explored: domain diversity, hostname wild-carding, path uniqueness, and attribute uniqueness. Implications of the findings suggest improvements for "URL blacklist" methods, methods of sampling to decrease the number of URLs that must be reviewed for safety, as well as presenting some challenges to the ICANN, Registrar, and Email Safety communities.