SE Village - Mattias Borg - SCAM CALL : Call Dropped

### The Global Epidemic of Tech Support Scams Tech support scams have evolved into a multi-billion-dollar transnational criminal enterprise, defrauding millions of vulnerable computer users worldwide. In this fast-paced presentation at the DEF CON 24 Social Engineering Village, security analyst Mattias Borg presents a detailed counter-intelligence case study ("scambaiting") dissecting the operational infrastructure, psychological manipulation, and financial laundering mechanisms utilized by organized call centers running tech support fraud.

### Anatomy of the Windows Event Viewer Scam At 02:48, Borg describes receiving an unsolicited cold call from an overseas boiler room claiming to represent Microsoft Windows Technical Support: - **The Social Engineering Pretext:** The caller claims that the victim's computer has been infected with dangerous trojans and is continuously transmitting malicious error telemetry across the internet. - **Fabricating Crisis via Event Viewer:** The scammer instructs the victim to open Windows Event Viewer (`eventvwr.exe`), pointing to standard, harmless operational warning and error logs (present on every Windows machine) as definitive proof of severe viral compromise. - **Establishing Remote Desktop Access:** At 07:37, the scammer directs the user to install commercial remote desktop administration software (such as TeamViewer or LogMeIn) to allow the technician to "clean the system."

### Establishing the Deceptive Honeypot Sandbox Rather than hanging up, Borg engages the scammer using an instrumented, hardened virtual machine sandbox: - **Forensic Monitoring:** The virtual machine was configured with active packet capture, file system auditing, and process execution monitors, capturing every file transferred and command executed by the remote operator. - **Simulating the Naive Victim:** The speaker acted as an unsophisticated, panicked non-technical user, playing along with the scammer's script to keep the session active and observe their full post-exploitation playbook.

### Counter-Intelligence Analysis and Scammer Attribution At 10:53, the presentation analyzes the deceptive visual tricks deployed by the scammer once connected to the desktop: - **Fake Cleanup Scripts:** The scammer opens a command prompt, modifies text colors using `color 0a`, and executes recursive directory listings (`tree C:\`) alongside batch scripts that print alarming fake status messages ("Trojan.Banker detected... System corrupted"). - **Exposing Scammer Infrastructure:** At 13:11, Borg leverages the scammer's operational sloppiness. Because the scammer left internal management sessions and unmasked desktop windows open, Borg extracted the scammer's real internal TeamViewer ID, origin IP addresses, email handles, and social media profiles. - **Money Laundering Routes:** At 16:00, the investigation reveals the financial cash-out pipeline: the scammer demanded hundreds of dollars in payment via wire transfers, prepaid debit cards, and third-party bank accounts linked to organized money mule networks.

### Takedown, Disclosures, and Community Defenses At 17:52, Borg details the operational aftermath and reporting process: - **Disrupting Scammer Tooling:** The author compiled forensic reports containing connection logs, session IDs, and uploaded malware hashes, submitting them to TeamViewer's abuse desk and relevant financial institutions to freeze the scammer's active commercial licenses and accounts. - **Public Awareness and Education:** Borg concludes by emphasizing that technical education, public scambaiting exposés, and defensive community awareness are the most potent tools to protect non-technical consumers from predatory social engineering cartels.

(AI summary — Gemini 3.8 Flash)