Infoblox Threat Intel has linked a global wave of mobile banking fraud to scam compounds in Cambodia, affecting users in at least 21 countries.
Working with Vietnamese non-profit Chong Lua Dao, researchers identified an Android banking trojan likely operated from several locations, including the K99 Triumph City compound in Cambodia. The UN and others have previously linked that site to large-scale scams and forced labour.
The operation came to light after a rise in unusual DNS traffic across Infoblox customer networks led researchers to what they described as a previously undocumented malware-as-a-service platform. The service appears to register about 35 new domains each month to imitate banks, social security agencies, tax authorities, utilities and law enforcement bodies.
The infrastructure targeted users in at least 21 countries, with the heaviest activity in Indonesia,…
PAYROLL & HR CONTROLS (PREVENTING “GHOST” SCHEMES)
Payroll fraud is often the hardest to detect because it “looks” like a normal business expense.
- Segregation of Duties (SoD): The person who adds new employees to the system must not be the same person who approves the monthly pay run.
- Mandatory Vacation Policy: Require all financial and HR staff to take 5–10 consecutive days of leave annually. Fraud often surfaces when the perpetrator isn’t there to “hide” the trail.
- Ghost Employee Audit: Perform a quarterly “Headcount Reconciliation” where managers must physically verify every name on their payroll list exists.
- Self-Pay Blocking: Ensure the payroll software has a hard-coded block preventing administrators from editing their own salary or bank details.