Trend Micro Teams Up with INTERPOL to Take Down Notorious Phishing Operation

16shop responsible for an estimated 70,000 global victims

SYDNEY, August 15, 2023 – Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today announced that its close cooperation with law enforcement has led to another major win after the dismantling of a prolific phishing-as-a-service (PaaS) operation.

Ashley Watkins, Vice President, Commercial ANZ, Trend Micro: "Trend has been a committed partner of INTERPOL for many years, so when the call came for help, we didn't waste a second. As this takedown proves once again, public-private partnerships backed by powerful threat intelligence can be a force multiplier for international cybercrime investigations."

Trend Micro was first approached by INTERPOL in 2020 when the policing alliance requested threat intelligence regarding PaaS site 16shop. The platform sold phishing kits designed to lower the barrier to entry to budding cybercriminals, enabling them to scale scam campaigns with ease.

Through its research, Trend found and reported to INTERPOL that:

• Attacks supported by 16shop were particularly prevalent in Japan, as well as the US and Germany.
• Customers of 16shop were able to craft phishing pages to harvest Amazon, American Express, PayPal, Apple, and CashApp credentials as well as US banking logins.
• The platform's phishing kits automatically localised the language of phishing sites depending on the victims' location.
• It featured capabilities designed to thwart analysis, such as anti-sandboxing and geolocated access restrictions.
• 16shop's web infrastructure was hosted across numerous legitimate cloud providers to further avoid detection.
• The site was active from 2018 until at least 2021, with copycat sites most likely springing up after this date.

According to INTERPOL, Trend’s threat intelligence report helped lead to the arrest of the suspected administrator of 16shop and two other suspects in Indonesia and Japan. In total, 16shop is estimated to have enabled phishing attacks on over 70,000 victims in 43 countries.

Trend’s close support of INTERPOL in this operation follows numerous previous engagements, including 2022's Operation African Surge, and the dozens of training sessions the cybersecurity provider has delivered to law enforcement agencies since 2014, including a five-day course recently held in Manila.

About Trend Micro

Trend Micro, a global cybersecurity leader, helps make the world safe for exchanging digital information. Fueled by decades of security expertise, global threat research, and continuous innovation, Trend Micro's cybersecurity platform protects hundreds of thousands of organisations and millions of individuals across clouds, networks, devices, and endpoints. As a leader in cloud and enterprise cybersecurity, the platform delivers a powerful range of advanced threat defence techniques optimised for environments like AWS, Microsoft, and Google, and central visibility for better, faster detection and response. With 7,000 employees across 65 countries, Trend Micro enables organisations to simplify and secure their connected world. http://www.trendmicro.com.au/