Cybercriminals capitalize on Silicon Valley Bank's demise

The illness of Silicon Valley Bank (SVB), erstwhile nan go-to financial institution for early-stage exertion businesses and startups, is being exploited by cybercriminals. In this blog post, we talk immoderate of nan strategies and techniques Netcraft has already detected criminals utilizing to utilization SVB’s illness – either straight aliases indirectly – arsenic a lure.

As nan flurry of COVID-themed attacks proved, cybercriminals discarded nary clip successful exploiting nan attraction specified stories generate. Criminals often utilization existent news stories, aliases circumstantial times of twelvemonth (like taxation reporting) to make their scam look much applicable to victims. They’ll besides usage nan fearfulness of missing out, hoping to instrumentality victims into responding quickly.

New SVB-themed websites abound – criminal and otherwise

Since news of SVB’s illness was announced, Netcraft has detected and blocked respective SVB-related attacks successful our malicious tract feeds:

One of nan websites pretending to beryllium a USDC Reward Program

svb-usdc[.]net and svb-usdc[.]com were some fraudulent sites, impersonating nan morganatic SVB website and claiming to connection a “direct payout” of nan USDC cryptocurrency. USDC is simply a stablecoin managed by a consortium including Circle and Coinbase which intends to way nan US dollar and was itself impacted by SVB’s collapse. It mislaid its notional 1:1 peg against nan dollar connected nan 11th March, dipping to 87¢, aft it announced it had $3.3B tied up successful SVB slope accounts. It has since recovered its peg and is operating normally.

A website claiming to connection SVB customers NFTs

svb.meta-shops.xyz is simply a fraudulent Web3 tract which will drain a user’s wallet if they authorize nan connection. It uses minimal SVB branding (the logo connected nan t-shirt), but nevertheless claims to beryllium them (“after 40 years of banking”) and offers a “free Silicon Valley Bankers NFT for each NFT you hold” (NFT = Non-fungible token). Based connected our first investigations, this tract posts updates to Discord arsenic a wallet is connected done WalletConnect and its contents are transferred, and has handling for various NFTs (including circumstantial handling for CryptoPunks).

One of nan websites claiming to beryllium All Day Capital Partners

We’ve besides detected a bid of sites utilizing opportunistic domain names specified arsenic wefundsvbclients[.]com and siliconvalleybankhelp[.]com. These sites do not impersonate SVB, but declare to beryllium a institution called ‘All Day Capital Partners’ (alldaycapitalpartners[.]com), offering to “assist each SVB customers”. This institution has registered these domains recently, apt pinch nan volition of capitalizing connected SVB’s notoriety.

A website pretending to beryllium SVB DAO

svbdao[.]xyz claims to beryllium a Decentralised Autonomous Organization (a member-run statement controlled utilizing a blockchain) group up “to put successful Silicon Valley Bank (SVB) arsenic portion of a syndicate to return it private.” As pinch galore caller cryptocurrency projects, it is sometimes difficult to distinguish betwixt bully intentions and scams. However, nan latest update connected its Twitter relationship states that members person voted to disband pursuing nan FDIC announcement that each costs will beryllium made whole.

A website claiming to bargain verified claims for cash

cash4svb[.]com offers to bargain claims from companies affected by nan SVB news and will “pay retired 65%-85% of nan declare value”. The page states it is not affiliated pinch Silicon Valley Bank and that they are “a backstage finance group based retired of Stanford, California”. Following nan FDIC announcement, they person posted an update connected nan page that they will beryllium “reversing immoderate purchases made and suspending offers going forward”.

A website claiming endorsement by Donald Trump

bigpatriots[.]com does not impersonate SVB directly, but is taking advantage of nan news to beforehand “Trump TRB Checks… …Former President Trump predicted Silicon Valley Bank, Now he is giving a chance to everyone to protect from nan disaster which is coming very soon”. The ‘Trump TRB Checks’ are billed arsenic pieces of memorabilia. This website makes circumstantial claims that these checks transportation a monetary value, and tin beryllium deposited successful immoderate slope account. Like different cryptocurrency finance scams, nan page makes usage of nan illusion of personage endorsement. In this case, a spoof video of Donald Trump endorsing these checks.

Suspicious societal media sites

In position of societal media:

• twitter[.]com/svb_support, joined February 2023, claims to beryllium “official support” for SVB bank.
• twitter[.]com/silliconvalleiy (note nan spelling), joined May 2021, is an relationship pinch 272 followers intelligibly impersonating SVB, and claiming to springiness distant cryptocurrency.

A position update by nan twitter personification @siliconvalleiy

What tin we expect to spot next?

We are chiefly seeing communications from various companies, reassuring their customers that they are not impacted by nan SVB incident. However, we expect that cybercriminals, impersonating morganatic companies, will commencement to nonstop phishing emails urging customers to “update their billing” specifications to debar being impacted by nan SVB event. The caller account’s specifications fixed will (of course) beryllium controlled by nan cybercriminal.

How tin Netcraft help?

Netcraft is nan world leader successful cybercrime detection, disruption, and takedown, and has been protecting companies online since 1996. We analyse millions of suspected malicious sites each day, typically blocking an onslaught wrong minutes of discovery.

1. Netcraft provides cybercrime detection, disruption and takedown services to organizations worldwide including 12 of nan apical 50 world banks. We execute takedowns for astir 1 3rd of nan world’s phishing attacks and return down 90+ onslaught types astatine a complaint of 1 onslaught each 15 seconds.

2. The Netcraft browser hold and mobile apps artifact fraudulent sites, specified arsenic those exploiting news of SVB’s demise. Our malicious tract feeds protect billions of group astir nan world from phishing, malware, and different cybercrime activities.