Hit Wicket: Inside The Expansive Web of Scams Targeting Millions of IPL Fans This Season

MITRE Techniques

• [T1583.001 ] Acquire Infrastructure: Domains – Threat actors registered and used large numbers of domains to promote betting platforms and redirect users (‘Over 1200 domains were found promoting illegal betting platforms’).
• [T1584.005 ] Compromise Infrastructure: Web Servers – Attackers abused compromised government websites to host injected betting links and manipulate search visibility (‘Multiple Indian government sites were found exploited and injected with links pointing to illegal IPL betting platforms’).
• [T1055 ] Process Injection – The article describes injected content added into website source code to alter page behavior and ranking (‘attackers inject backlinks to illegal betting platforms directly into these sites’ source code’).
• [T1566 ] Phishing – Bulk messages and deceptive promotional content lured users toward betting and loan apps through fraudulent links (‘mass unsolicited text messages promoting betting platforms’ and referral funnels).
• [T1598.003 ] Phishing for Information: Spearphishing Link – Users were enticed through referral links from tippers and ads to click into illicit platforms (‘What they are actually selling is a referral link’).
• [T1649 ] Steal or Forge Authentication Certificates – Deepfake impersonation was used to forge believable endorsements from celebrities and cricketers (‘deepfake tools to clone the faces and voices of well-known cricketers, news anchors, and celebrities’).
• [T1036 ] Masquerading – Fake tipper personas posed as insiders such as ex-analysts or professional gamblers to gain trust (‘running channels under personas crafted to project insider credibility’).
• [T1036.005 ] Masquerading: Match Legitimate Name or Location – Fake loan apps and betting pages impersonated legitimate services to appear trustworthy (‘Instant loan apps’ and legitimate-looking betting platforms’).
• [T1102 ] Web Service – Threat actors used Telegram, Instagram, YouTube Shorts, WhatsApp, Meta Ads, and Google Ads as operational channels (‘operate primarily on Telegram, Instagram, and YouTube Shorts’).
• [T1090 ] Proxy – Money mules and registered business accounts were used to move funds while hiding the real operators (‘bank accounts set up to receive user deposits – registered under business entities rather than individual names’).
• [T1496 ] Resource Hijacking – Not applicable in the strict compute sense; however, the article describes exploitation of user and website resources for illicit monetization (‘supporting underground economy’).