Skip to main content

U.S. DoD tricked into paying $23.5 million to phishing actor

  • May 2, 2022
  • 4 replies
  • 9 views

kleinmat4103
Popular Voice
Forum|alt.badge.img+6

By Bill Toulas  May 2, 2022

 

According to the criminal complaint against Oyuntur in 2019, the damage from the phishing fraud occurred in September 2018.

Oyuntur and his conspirators registered the domain "dia-mil.com", which is very similar to the legitimate "dla.mil, and used it to send phishing emails.

These emails were delivered to users of SAM (System for Award Management), which is a vendor database where companies that want to conduct business with the Federal Government register themselves.

The phishing messages contained links to a cloned "login.gov" website, where the victimized vendors entered their account details, unknowingly exposing them to Oyuntur.

 

<<Read the Whole Thing>>

4 replies

kleinmat4103
Popular Voice
Forum|alt.badge.img+6
  • Author
  • Popular Voice
  • May 2, 2022

So disappointing that a classic phishing scam could be so successful at this level of government.

By logging in onto the SAM database as the victimized corporation, Oyuntur changed the registered banking information, replacing the foreign account with one that he controlled.

 

Are we to understand that the SAM database did not require MFA, and the bank account information for a client can be changed without any verification?

 

At least they eventually caught him, but took them 4 years!


stlshark
New Member
Forum|alt.badge.img+1
  • New Member
  • May 2, 2022

Ouch. That is a very bad situation. Glad it was all resolved over time. Goes to show how easy it is to trick someone into giving you the keys to the kingdom though. 


MunkeyMan
New Voice
Forum|alt.badge.img+4
  • New Voice
  • May 2, 2022

This is huge. How can such a huge organisation fall for such a basic scam??


russell.harris
Popular Voice
Forum|alt.badge.img+5

I still don’t understand how such simple scams are fallen for