Fraudsters disguised themselves as the Investigative Committee

In mid-August, scammers launched a mass mailing of phishing emails purporting to be from the Russian Investigative Committee. Using domains that are as close as possible to the official domain names of the investigating authorities, they send out letters demanding to get acquainted with the materials of the criminal case. One of the Vedomosti employees received such a letter. The mailing was also recorded by representatives of RTK-Solar and Kaspersky Lab.

In the letter, which was also received by the Vedomosti employee, the attackers notified the recipients that they were witnesses in a certain criminal case, and asked them to inform about the possibility of attending the court session in person. The sender of the letter was “Roman Anatolyevich Dvornikov, Senior Investigator of the Investigative Committee for Moscow”, and the mail domain imitated the real mail of the investigative committee employees – @mail – server1 – sledcom.org instead of sledcom.ru. Also, a malicious link was attached to the letter, which allegedly led to the case card, but in fact activated the malicious program.