A Florida teenager who served as a lackey for a cybercriminal group that specializes in cryptocurrency thefts was beaten and kidnapped last week by a rival cybercrime gang. The teen’s captives held guns to his head while forcing him to record a video message pleading with his crew to fork over a $200,000 ransom in exchange for his life. The youth is now reportedly cooperating with U.S. federal investigators, who are responding to an alarming number of reports of physical violence tied to certain online crime communities.

The grisly kidnapping video has been circulating on a number of Telegram chat channels dedicated to SIM-swapping — the practice of tricking or bribing mobile phone store employees into diverting a target’s phone number, text messages and calls to a device the attackers control.

The teen, known to the SIM-swapping community by the handle “Foreshadow,” appears to have served as a “holder” — a term used to describe a low-level member of any SIM-swapping group who agrees to carry out the riskiest and least rewarding role of the crime: Physically keeping and managing the various mobile devices and SIM cards that are used in SIM-swapping scams.

“Yo, Dan, please bro send the 200k,” Foreshadow said in the video, which was shot on Sept. 15 in the backseat of a moving car. Bleeding from a swollen mouth with two handguns pointed at his head, Foreshadow pleaded for his life. A still shot from that video is available here [Warning: the image is quite graphic].

“They’re going to kill me if you don’t,” Foreshadow continued, offering to get a job as a complicit mobile store employee or “plug” to help with future SIM-swaps. “I’ll pay you back. Just let me know what you need. I got you, for real. Any work for free. Whatever. However long you need me, too. I’ll apply to any store you need me to apply to. I can be a plug. I don’t care if I get caught by the cops or anything. I’ll get that money back for you. I used to do that work.”

It’s not clear where in the world the hostage video was recorded. But at one point in the video, the vehicle’s radio can be heard in the background mentioning WMIB, which is a hip-hop station in South Florida that serves both Ft. Lauderdale and Miami.

As Foreshadow’s hostage video began making the rounds on SIM-swapping Telegram channels, a rumor surfaced that Foreshadow had died after being shot in the leg. It soon emerged that Foreshadow had not died, and that he was cooperating with the Federal Bureau of Investigation (FBI). Members of the SIM-swapping community were then warned to delete any messages to or from Foreshadow. One of those messages read:

JUST IN: FORESHADOW IS NOT DEAD!!!!
HES CURRENTLY CO-OPERATING WITH THE FBI DUE TO HIM BEING KIDNAPPED AND AN ATTEMPT TO EXTORT HIM FOR 200K
IF YOU HAVE CHATS WITH HIM CLEAR THEM

Click to expand...

Click to shrink...

Foreshadow appears to be a teenager from Florida whose first name is Justin. Foreshadow’s main Telegram account was converted from a user profile into a channel on Sept. 15 — the same day he was assaulted and kidnapped — and it is not currently responding to messages.

Foreshadow’s erstwhile boss Jarik told KrebsOnSecurity that the youth was indeed shot by his captors, and blamed the kidnapping on a rival SIM-swapper from Australia who was angry over getting shortchanged of the profits from a previous SIM-swapping escapade.
The FBI did not immediately respond to requests for comment.

Reached via Telegram, the alleged mastermind of the kidnapping — a SIM-swapper who uses the handle “Gus” — confirmed that he ordered the attack on Foreshadow because the holder had held back some of his stolen funds. In the same breath, Gus said Jarik was “gonna get done in next” for sharing Gus’ real name and address with KrebsOnSecurity.

“No1 cared about that nigga anyway, he snaked targs [targets] and flaunted it everywhere,” Gus said of Foreshadow. “I’ve been fucked over so many times I’ve lost millions. I am just a guy trying to make more money.”

Foreshadow’s experience is the latest example of a rapidly escalating cycle of physical violence that is taking hold of criminal SIM-swapping communities online. Earlier this month, KrebsOnSecurity detailed how multiple SIM-swapping Telegram channels are now replete with “violence-as-a-service” offerings, wherein denizens of the underground hire themselves out to perform various forms of physical violence — from slashing tires and throwing a brick through someone’s window, to conducting drive-by shootings, firebombings and home invasions.

Click to expand...

Click to shrink...

src: https://krebsonsecurity.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/ / (archive) / (archive 2)

Here are the videos that Krebs is too scared to show you:




Telegram has long been a haven for fucked up individuals of all sorts. Islamic state terrorists, white nationalists, crypto scammers, pedophiles, zoophiles, and many more have chosen Telegram as their place of gathering since the inception of the app, which markets itself as a Very Secure and Private messaging platform, and has received constant media and press attention for all of the fucked up shit that is allowed on the platform. Although these type of communities also have a large presence on Discord, their servers get banned all the time and it is very difficult to keep track of activity.

Cybercriminals and hackers have always been on Telegram, but recent events are uncovering a different side of Telegram's black-hat community. These guys aren't interested in developing malware or breaching and exfiltrating sensitive data like LAPSUS$, they are more interested in going for the money directly, using targeted phishing and SIM swap attacks to get access to online banking logins, credit card info, crypto wallets, Cashapp, Paypal, whatever, or they take advantage of loopholes in E-commerce stores to offer refund/return scam services, or high-value goods for cheap. These aren't kids with an interest in computer programming or cybersecurity, these are low-to-middle-class American kids looking to drop out of school and buy a hot fancy car and the newest iPhone and fuck some hot bitches or whatever.

While you read and watch the videos in the rest of this OP, I want you to keep in mind that these motherfuckers specifically target individuals and groups such as families or small businesses. They actively hunt for those they perceive to be weak, referring to them as "targs" (targets), such as the elderly, the disabled, and the technologically inept. (I don't have the got damn time to learn all that techno-geek-shit, I work 60 hours a week!)

Click to expand...

Click to shrink...

As you may have seen above, tensions can escalate between these individuals/groups and bad shit can happen. You can see plenty of beef between random people sprinkled in among all the advertisements for different blackhat services as soon as you join any group dedicated to the topic. Some who are skilled in the art of OSINT offer paid doxing and swatting services, or they'll even advertise literal hits, where they take your money to go fuck somebody up in person. Sometimes, videos are shared or leaked which depict these incidents:

Click to expand...

Click to shrink...

It doesn't seem like a very friendly community. You can find countless instances of hostility between members of these groups. I have no fucking idea how these guys get anything done. When you read through some of these groups, you will quickly notice that there is not a hint of coherent discussion. Not even the ones who advertise services seem to be any better. Most of the time, I don't even know what service or information they are selling, because I can't decipher the lingo apart from obvious shit like CC = credit card. I have no idea how someone "new" to this shit would even begin to learn how to actually scam people or fuck with the bank accounts of their "targs".

Click to expand...

Click to shrink...

Many people who participate in this type of online crime have extraordinarily poor security practices and are prone to flaunting their ill-gotten gains and their tools of the trade, posting videos of drugs, money, online banking dashboards, blank credit cards, and more. Some go as far as to film themselves withdrawing large amounts of money from ATM machines to prove that they are "legit". I must mention now that many of these groups and channels make use of a feature of Telegram that is supposed to prevent users from saving, copying, or forwarding messages and files from groups that have it enabled.

It isn't working.

Click to expand...

Click to shrink...

An unfortunate reality of the situation is that there is a significant amount of school-aged children involved in this scene. They fall into it because they are given both positive and negative attention by older members, and essentially become a meme throughout this community. They are encouraged to talk trash and say stupid shit in public, they are also encouraged to commit lower end crimes for members of the group, sometimes even filming it. One of them was busted by their own mother after someone doxed a little kid and told his mother he was scamming people.

Click to expand...

Click to shrink...

I feel really fucking bad for parents in the 2020s.

There is a concerning amount of Telegram groups and channels out there like the ones i've gathered these videos from. Type in any keywords related to SIM swapping, carding, refund scams, or bank logs, and you'll find them. Sorry, but I can't just link you to these places. If you want to see this shit for yourself, strongly consider making an alternative Telegram account. Don't get in on the action, just get a job. You will get scammed, they will accuse you of being a fed, and you could end up being the next dude to get kidnapped and beaten for the world to see.

As economies around the world continue to collapse, and the prices of housing, food and education continue to rise, I feel that many more children and young adults will turn to this kind of criminal behavior to make some quick bread and get expensive shit like iPhones and Xboxes for cheap. This shit feels like its straight out of some criminal cyberpunk dystopian future.

Stop using SMS for 2FA.