Security1 publisher2 min readPublished
Tajin Group runs its Telegram fraud accounts on bought usernames and anonymous virtual numbers
Recorded Future's profile of a phishing and money-laundering vendor on the Dabai and Xinbi guarantee marketplaces documents at least 100 Telegram usernames and multiple virtual numbers bought via Fragment Market.
The Watch · Security desk
What happened
- Recorded Future published a profile of Tajin Group, a third-party vendor selling on two Telegram-based Chinese-language guarantee marketplaces, Dabai Guarantee and Xinbi Guarantee.
- The group's business is phishing, payment card theft and money laundering, and it actively targeted mainland Chinese citizens and Chinese banks.
- Its operators have bought and sold at least 100 Telegram usernames and multiple phone numbers through Fragment Market, which trades virtual anonymous numbers alongside usernames.
- Recorded Future says marketplace users increasingly link several usernames and one anonymous virtual number, in place of a SIM card, to a single Telegram account.
- Tajin Group moved its operation from Dabai Guarantee to Xinbi Guarantee after falling out with earlier payment card suppliers.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Recorded Future states the purpose of the virtual numbers is to avoid detection. A registration number bought and resold on a market is a poor anchor for linking accounts to each other or to a subscriber.
- exposure Card issuers in twelve countries sit in the test population, reached through the CCAvenue and Geidea platforms, even though the group's named victims were Chinese.
- cost Banks, fund transfer service providers and cryptocurrency exchanges absorb the losses from this trade, along with the individuals who fall into the scam campaigns.
- precedent Recorded Future expects other groups on these marketplaces to copy Tajin's methods, so fraud teams should treat bought numbers and rotating usernames as the vendor population's default.
Both halves of a Telegram identity are for sale here. Fragment Market sells the usernames and it sells the numbers, and Tajin Group's operators traded in both directions on it [7]. Recorded Future frames the move to anonymous virtual numbers as an operational security measure, taken to avoid detection and to reach a wider audience [9]. The report documents the tactic and the intent without measuring what the change costs an investigation.
The marketplace side puts the practice in proportion. Tajin is one third-party vendor [11]. Recorded Future describes these Chinese-language guarantee marketplaces as consisting of hundreds to thousands of third-party vendors each [13]. At Tajin's rate of at least 100 usernames per vendor, one marketplace would turn over 10,000 to 100,000 usernames if Tajin is typical, and the report stops short of saying it is [15].
Tajin also detailed its own operating problems: intense competition from rival groups, and trust issues with its previous payment card suppliers [6]. Vendors on these marketplaces are not necessarily loyal to one of them [5].
On the money side the group shopped for partners. It sought direct payment channels accepting UnionPay, VISA, Mastercard, JCB and Apple Pay, ways to exploit 2D, 3D and other payment gateways, and UAE dirhams and electronic gift cards for theft and laundering [4]. The group demonstrated what Recorded Future calls a nuanced understanding of the prerequisites for moving funds overseas or using other people's payment cards remotely [2].
Guarantee marketplaces have been growing as an alternative to Chinese-language dark web markets since Huione Guarantee's model gained prominence around 2021 [12]. Recorded Future describes them as a force multiplier for cooperation among Chinese-speaking groups: recruitment, crowdsourcing information, sharing resources, and deploying personnel to commit crimes that require in-person interaction [14].
What to watch
- Whether Fragment Market's resale of Telegram usernames and virtual numbers draws enforcement or a platform-side restriction.
- Whether Xinbi Guarantee, now Tajin Group's home platform, faces action, and which marketplace its vendors move to next.
- Whether CCAvenue and Geidea tighten controls on the small test transactions used to validate stolen card ranges.