FBI and Indonesian Police Disrupt W3LL Phishing Platform
Summary
The FBI and Indonesian police disrupted W3LL, seized infrastructure and domains, and arrested its alleged developer. Group-IB said its tools targeted 56,000+ Microsoft 365 accounts; the FBI cited thousands of compromised accounts and over $20 million in attempted fraud.
Key points
- The FBI said it seized infrastructure supporting W3LL; Indonesian police arrested the alleged developer, identified by the FBI as G.L., and seized related domains.
- W3LL Panel, reportedly sold for about $500, created fake login portals to capture credentials and bypass multifactor authentication.
- W3LLSTORE advertised more than 25,000 accounts for sale between 2019 and 2023, including login credentials and remote desktop access.
- The FBI said the platform enabled the theft of thousands of credentials and more than $20 million in attempted fraud.
- Group-IB said W3LL tools targeted more than 56,000 corporate Microsoft 365 accounts from October 2022 to July 2023, and described a community of at least 500 threat actors.
- The FBI said W3LL continued to be marketed through encrypted messaging platforms after W3LLSTORE shut down in 2023, and was used in attacks on 17,000 victims globally from 2023 to 2024.
Article Details
- Event Type
- Law enforcement disruption of the W3LL phishing platform, including infrastructure and domain seizures and the arrest of its alleged developer.
- Impact
- The W3LL phishing kit enabled buyers to create fake login portals that captured credentials and were used to bypass multifactor authentication and maintain account access. The FBI said W3LLSTORE advertised more than 25,000 compromised accounts for sale between 2019 and 2023 and enabled attempts at more than $20 million in fraud. Group-IB reported that W3LL tools targeted more than 56,000 corporate Microsoft 365 accounts in the USA, UK, Australia, and Europe from October 2022 to July 2023; the FBI said the tool was used in attacks on 17,000 victims globally from 2023 to 2024.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe fake login portals captured credentials entered by victims.T1078 · Valid AccountsThe article says stolen credentials were used to access accounts and maintain access.T1566 · PhishingW3LL tools were used to create fake login portals to trick victims into providing credentials.
People
Vendors
Products
Microsoft 365 Apps for EnterpriseGroup-IB linked W3LL activity to attacks on more than 56,000 corporate Microsoft 365 accounts and a network of at least 500 threat actors.W3LLSTOREThe W3LL kit and its W3LLSTORE marketplace enabled buyers to create MFA-bypassing fake login portals, sell thousands of compromised accounts, and facilitate over $20 million in attempted fraud.
Tools
W3LLLaw enforcement, including the FBI and Indonesian police, dismantled the W3LL phishing platform, seized infrastructure and domains, and arrested the alleged developer.W3LL Panela closed community of at least 500 threat actors who could purchase a custom phishing kit called W3LL Panel, designed to bypass MFA, as well as 16 other fully customized tools for business email compromise (BEC)
Countries
AustraliaW3LL’s phishing tools were used to target over 56,000 corporate Microsoft 365 accounts in the USA, UK, Australia and Europe between October 2022 and July 2023,” the company said, noting that it was reporting itsIndonesiaA widely used phishing tool called W3LL was disrupted by the FBI and law enforcement agencies in Indonesia on Friday.United Kingdomthat W3LL’s phishing tools were used to target over 56,000 corporate Microsoft 365 accounts in the USA, UK, Australia and Europe between October 2022 and July 2023,” the company said, noting that it was reportingUnited Statesthat W3LL’s phishing tools were used to target over 56,000 corporate Microsoft 365 accounts in the USA, UK, Australia and Europe between October 2022 and July 2023,” the company said, noting that it was