In this video I want to go over a actual investigation.
And again, this is a real investigation.
However, instead of showing you the original email and the, uh, the process itself and having to
redact images and names and whatnot, I'm just going to go through what happened and also on the investigation
side, so you can actually kind of go through and see that how everything you learned in this class
can be actually applied.
Now, this started off as a phishing email with essentially what is a old check cashing scheme.
Now the old method for this was for example, you would post a car on a classified like Craigslist or
in the newspaper or both and say you're selling a car.
Someone would mail you a check, so the check would be for the amount of the car, or maybe even a little
above the amount of the car, and they would typically tell you, hey, I really want that car.
I'm willing to pay $500 extra for it just so you sell it to me.
Here's a check.
Go ahead and deposit it.
Give me a call or give me a text message when you deposit it.
And since checks take a while for to clear, it could take several days.
It could take a week to clear.
Uh, what would happen is when you contact them and say, hey, I deposited your check, they would
say, well, I changed my mind.
I changed my mind.
Give me my money back, wire me my money back.
And what happens is when you wire the money back, of course, again, it would take several days to
over a week for the check to clear.
Once that check, the bank finally looks over that check and realizes, well, that check bounced.
Then you're on the hook for the amount for the money that you gave back to that person.
So essentially, you're losing money.
And this is essentially what this this attack was.
So let me go over it.
So a couple people got phishing emails posing as a conference and they had to fill out some information.
So in that information it was a Google form.
And the Google form asked for their name and their email address and password information and that which
should have flagged these users.
But since the person was using the guise of authority, an authority of their manager, that they went
ahead and went ahead and filled out the information without really thinking about it.
So because of that, the users fell victim to a credential harvesting attack.
The attackers now had their email address and their login.
So since they had that, the attackers use the emails and all of the contact list.
And then from there they emailed a bunch of people on their contact list with a job opportunity and
a form to fill out.
So in that form, they didn't ask for their email and password because again, this is this was a financial
scam.
So what they did ask for was they asked for their name, their personal email address, their phone
number.
Know it's important that they wanted their personal email address because they wanted to get the victims
off of our network.
Because once you get someone off of a particular platform, say you're talking to someone on Facebook
and they go, hey, do you have WhatsApp?
Let's talk on WhatsApp instead.
They're trying to get you off of something that is more secure to something that is less secure.
So that's what the personal email was for.
They would have the the people fill out the form, and when they filled out the information, they would
send them a text message.
And in the text message they would give them information about this job opportunity.
Hey, you can make, you know, this money real quick.
And you know what?
We're going to give you, uh, $300.
And the amount changed as as it went on.
Start off with $300 and, uh, go ahead and deposit that check.
So they they send an actual text message with a picture of a check, and they told them, go ahead and
deposit this deposit in your bank.
And when you deposit, let us know.
So once the check was deposited, the scammers would rescind the job opportunity.
So again this is just like the the older check cashing scheme that they would mail out.
This was just done much more efficiently because it was through a text message much quicker.
And again, since it wasn't a real deposit, the person would lose their money once they give the money
back.
So on the investigation side, I checked the email and as it was a generic Gmail email address, so
a little bit harder to check.
So it was a newly created Gmail attack.
Just for this attack wasn't a data breaches, it wasn't used anywhere else and whatnot.
Did a reverse phone lookup on the text message so the the number was not a VoIP number in this case.
So that was very useful.
Checking the voice message using a spy dialer, it routed to a Google Voice number.
So because it ran to a Google Voice number, it gave a little bit of an amenity.
But again, this was not a VoIP number, it was an actual T-Mobile number in this case.
So I ran the phone number through a reverse number, which I got the name.
Now, I ran this through multiple reverse phone number lookups in order to validate that information.
And again, it is very important to validate any information that you find.
Because that information might be old, it might be invalid.
So getting that information I verified the name and the carrier.
I then did a name lookup, found the name, address, family members, neighbors, etc. again validated
that information on other sources, multiple sources, and I was able to verify the credibility of that
information.
So having that information for the name address then went to Google Maps and Street View to look up
the satellite views for that property.
So took some images of the property.
Uh, got an idea of their location, did a property record lookup in their state and county?
Also did criminal lookup on that person?
So in this case, there was no criminal hits in the state database.
And that's important.
It's I checked the person's state that they currently lived in.
Now, that doesn't mean that they've never done any crimes.
It just means that either they never did any crimes in that in that state could have been another state.
I could expand that search out.
Or maybe they never got caught of anything.
So.
And also I went a little bit further, did things like I looked up their voter records, see where they
registered to vote and whatnot, just to get a better idea of who who these people were.
So collecting that information, the outcome was that may be the actual attacker that perpetrate this,
or they could possibly be the victim of SIM swapping, meaning that someone could have cloned the the
phone sim of that phone and and did these attacks, especially since it wasn't a VoIP number that that
means that they were either, uh, again a victim of SIM swapping, or they were very careless and ultimately
took the information and was handed off to law enforcement because, again, this is a legal issue.
It's a financial scam.
So this is detailing a real life scam and a real life investigation to kind of show you how you could
take the different tools and methodologies that you learned in this course and actually apply it in
real life.
Hope this was useful.
Thanks for watching.
I'll see you in the next video.