Recorded Future has published a profile of the Tajin Group, a third-party vendor advertising phishing, payment-card theft and money-laundering services on two Telegram-based Chinese-language guarantee marketplaces, Dabai Guarantee and Xinbi Guarantee. The group's principal victims are mainland Chinese citizens and Chinese banks, but the operation is not geographically contained: researchers found the group conducting extensive live testing of payment cards belonging to multiple countries against the gateways CCAvenue and Geidea, and holding Bank Identification Numbers for cards from twelve countries — the BIN being the card's issuer and product identifier, and the group's inventory of them being the practical measure of how far its supply reaches. It actively seeks partner groups able to offer direct payment channels accepting UnionPay, VISA, Mastercard, JCB and Apple Pay, and to exploit 2D and 3D payment gateways, settling through UAE Dirhams and electronic gift cards. The operation is also visible in its supplier choices: it pivoted from Dabai Guarantee to Xinbi Guarantee, indicating that vendors on these marketplaces do not stay loyal to a single platform, and it has bought and sold at least 100 Telegram usernames and multiple virtual phone numbers through Fragment Market, giving operators multiple linked handles and an anonymous number in place of a SIM. That identity layer is the analytically significant finding, because it means the same criminal can present as several distinct, verified-looking parties without registering a single SIM. Recorded Future's assessment is that the potential financial return will push other vendors on these marketplaces to replicate the same tactics on a global scale — the group's methods are, in effect, a playbook that is now circulating.

• Source article