Threat Intel
Singapore Delivery Scams: Three Fraudster Groups Exposed by Group‑IB
Group‑IB has identified three distinct fraudster collectives orchestrating delivery‑based scams targeting Singapore consumers and businesses. The groups exploit legitimate courier services to deliver counterfeit or tampered goods, often as part of larger phishing or ransomware campaigns. Defenders should monitor shipment logs, verify sender authenticity, and educate staff on red‑flag indicators.
Group‑IB’s latest threat‑intel report reveals three separate fraudster collectives that have been executing delivery‑based scams across Singapore. The groups use legitimate courier networks to ship counterfeit or tampered items, then leverage the physical delivery as a foothold for phishing, credential theft or ransomware distribution.
What Happened
Over the past six months, investigators traced a pattern of suspicious shipments arriving at corporate mailrooms and residential addresses. Each package contained either a fake product, a device with a hidden keylogger, or a USB drive pre‑loaded with malware. The fraudsters coordinate via encrypted messaging apps and use spoofed sender addresses that match well‑known e‑commerce sites.
Impact
- Corporate mailrooms and warehouses have experienced unauthorized access to sensitive documents.
- Several small‑to‑medium enterprises reported credential compromise after employees opened tampered packages.
- At least three ransomware incidents were linked to the delivery vectors, causing downtime and data loss.
What Defenders Should Do
- Implement a shipment‑verification process: cross‑check courier tracking numbers against internal order logs.
- Use tamper‑evident packaging and RFID tags for high‑value items.
- Educate staff to treat all unexpected deliveries as potential threats; require two‑factor authentication for package access.
Mitigation Steps
"Deploy a dedicated delivery‑monitoring tool that flags anomalous shipping patterns and integrates with your SIEM. Combine this with endpoint protection that scans USB devices before they are connected to corporate networks."
Additionally, maintain an up‑to‑date inventory of approved suppliers and enforce a strict vendor‑onboarding policy that includes verification of shipping addresses and carrier credentials.
Related articles
Saudi Manpower Provider Scam: 1,001 Fake Domains Identified by Group‑IB
Group‑IB uncovered 1,001 domains used in a phishing campaign that impersonated a Saudi manpower provider, targeting users in KSA. Defenders should block these domains, update filtering rules, monitor for new registrations, and educate users to mitigate credential theft and potential malware delivery.
Read briefing
Ransomware Landscape Shifts: Q2 2026 Report Highlights Growing Competition and AI‑Accelerated Ops
Check Point Research’s Q2 2026 ransomware report shows the ecosystem is still dominated by a handful of RaaS groups, but the tail is widening: 93 active actors now versus 71 in Q1, with the top 10 accounting for 57.6 % of victims (down from 71 %). Victim numbers stayed flat quarter‑on‑quarter, yet the US share dropped to 42 % as new groups like The Gentlemen and Krybit target fewer American targets. The Gentlemen’s internal leak revealed an AI‑powered ransomware‑management panel built in three days, marking the first hard evidence that generative‑AI is speeding up malicious tool development. P
Read briefing
APT SideWinder Infrastructure Unveiled by Group‑IB and Bridewell
Security researchers Bridewell and Group‑IB have mapped previously unknown command‑and‑control infrastructure used by the APT SideWinder group. The new intelligence reveals a set of IP addresses, domains, and malware hashes that can be leveraged by defenders to harden detection and response. Security teams should ingest these indicators into their SIEM, XDR, and threat‑intel platforms and review network traffic for anomalous outbound connections.
Read briefing
JS‑Sniffers 2 (G‑Analytics Family) – Underground Sale of Stolen Card Data
Group‑IB uncovered a new underground marketplace selling payment‑card data harvested by the JS‑Sniffers 2 threat actor. The malicious JavaScript injects into compromised sites, capturing card details before exfiltration. Defenders should scan for obfuscated scripts, enforce CSP, and audit third‑party code.
Read briefing