Over the past 2 weeks, Digital Risk Protection Group-IB specialists have recorded on the Internet more than 12,800 offers for the sale of vaccination certificates and QR codes, including official Sputnik M vaccination certificates for children. In total, over the past 3 months - from November 2021 to January 2022 - the number of such illegal offers exceeded 110,000. For comparison, in September-October 2021 there were just over 3,000. According to Group-IB experts, most often such services can be found in Telegram channels, as well as on specialized sites, social networks and shady forums.
“There are significantly more offers, but prices have dipped a bit compared to autumn,” notes Evgeny Egorov, Lead Analyst of the Digital Risk Protection Group-IB Department. - Currently, the price for the "combo option" - a certificate + a QR code - varies from 5,000 to 8,000 rubles (in the fall, we recall, the "plug" was from 3,000 rubles to 30,000 rubles), you can also purchase a separate QR - code for about 2,000 rubles. There are still quite a lot of certificates with foreign vaccines, the choice is large - most often they offer Pfizer, AstraZeneca, Moderna, AD26.COV2-S from Janssen.”
Of the new ones that have appeared on the underground market, these are offers to sell supposedly official vaccination certificates for children with the Sputnik-M vaccine - their cost starts at 7,000 rubles.
"Mammoth" makes money on COVID-19In turn, CERT-GIB (Group-IB Information Security Incident Response Center) recorded a new way of fraud on the topic of COVID-19. On social networks and on dating services, attackers offer to buy a fake vaccination certificate or a negative PCR test. To do this, you need to go to the telegram bot, using the received "invitation code" to access it.
This code is a unique identifier for a worker, an ordinary member of a fraudulent group, in a scam team, who will then receive a percentage of the amount of money stolen from the victim. Recall that special telegram bots are actively used by scammers as part of the Mammoth (Courier) and Fake Date (Antikino) schemes.
After entering the code, the bot offers the victim an extensive list of services: the purchase of vaccination certificates and a certificate of a recovered person allegedly marked in the registry, positive and negative PCR tests through official clinics, as well as the opportunity to replenish their “wallet”.
The cost of obtaining a certificate of vaccination with the Sputnik-V vaccine with a QR code and posting to the registry is 9,990 rubles, and for Sputnik Light - 7,990 rubles. The most expensive thing will have to be paid for a certificate of a recovered person - 14,990 rubles. A positive PCR test costs 1990 rubles, a negative PCR test costs 1290 rubles, a "fake" PCR test costs 990 rubles.
“After selecting the desired “service”, the bot generates an invoice and offers to pay for it by transferring it to an electronic wallet of an individual. faces,” says Yulia Zingan, Senior Analyst at CERT-GIB. - Naturally, the money will go to the attackers and the "service" will not be provided. In this case, the victim, most likely, will not report fraud, since he will then have to admit his intentions to circumvent the law.
Group-IB experts remind that falsification of official documents, their acquisition, as well as the use of deliberately false documents, including vaccination certificates, is a criminal offense - Art. 327 of the Criminal Code of the Russian Federation. In addition to problems with the law, there are high risks that buyers of fake certificates will face scammers who steal money or bank card data.
bbabo.Net