Cybercriminals hire locals to spy on you (safety)

Cybercriminals rely on anonymity for their protection, but they increasingly need local intel on what is happening in their target’s life on their target’s turf. Meet the shady side of local surveillance.

My source contacted me via an unknown phone number at the urging of a CyberShack reader who knows we write about online and offline safety.

Meet Lenny (not his real name), who receives $1000 in Bitcoin weekly to provide local surveillance on selected targets. Bitcoin is untraceable; it keeps him in cigarettes, and he is building a nice off-the-books stash.

I did not meet Lenny in person because his anonymity and ability to morph to suit the territory are paramount. While I can’t verify his information, it is too complete and convincing to be far from the mark. Why did Lenny open up? He is basically an honest person and regards what he is doing as largely legal.

What is a Lenny?

Lenny (this one, anyway) appears as a middle-aged homeless person in the typical ragged flannel shirt, hoodie, baseball hat, and dirty track pants. This unremarkable figure walks his territory’s streets day or night, blending into the surroundings.

How many Lennys?

Lenny was recruited a few years ago by a local criminal gang member visiting the homeless hangouts to assess potential. Who would not be interested in $1000 a week and a new phone? After a test period, Lenny had a territory.

Lenny knew that watchers covered most of the City of Sydney LGA and western Sydney (from Burwood to Marsden Park). He is aware the network operates in every capital city and many regional towns.

He was recently ‘offered’ a stint to be a lookout for a juvenile criminal crew. That was a step too far as these kids act violently and with underage legal impunity, and he will soon move to another territory.

What is his territory?

Lenny has a 30-block territory with residential and business properties, excluding apartments or offices with front-door security. This is his fifth territory, and he moves on every 12 months. There are many Lennys.

Police can often tell if watchers move into the area as the crime rate per capita increases with their effectiveness.

What is Lenny’s brief?

He receives a list of targets each week via an app to observe:

  • The number of adults and children. Names and photos, if possible.
  • Times each leave/return from work/school/social.
  • Mailbox location and whether locked.
  • Rubbish bin collection day (see dumpster diving later).
  • Possible break-in entry points and assessment of risk factors.
  • Higher-value items like bikes or even exotic plants
  • Security cameras, if installed.
  • Access codes if visible.
  • Location of power box and gas (see breakbox later).
  • Holiday or regular shopping/social outings leaving the home empty.
  • Make, model, colour of car/s, number plate, parking on-street, carport, secured, etc.
  • Location of Council cameras and streetlights.

In a business case, it is more about stock held, delivery patterns, security, theft opportunities, etc.

It often takes a month or so to collect information on each target. He discreetly takes photos where he can, which are anonymously uploaded via the app. AI then attempts to face-match.

He believes cybercriminals use Google Maps Street View (AutoEvolution 22/11/24 confirms this) to identify the targets.

When he does not get a list or has spare time, he patrols the area looking for more immediate targets using the app to send back the data to ‘who knows where’.

What is done with the data?

He believes the target list comprises those who may yield more value in burglaries or are easy targets. Some observations are useful for cybercrime like ID Theft.

Breakbox

Where the power box is accessible (as meter readers must access it), Lenny switches off the power and waits to see if anyone comes out. If not, he uses the app, and gangs emerge a short time later to break into the home.

Most electricians can retrofit a secure box with a clear panel to stop breakbox.

Porch bandits

He uses the app to report parcels left on the porch by couriers. Shortly after, a gang drives by and grabs the parcel. Courier companies report in 2024, the average porch theft rate was 154 out of every 10,000 parcels, up from 6 per 10,000 in 2020. The rate varies by area, with many three times that.

He never takes goods from the mail, bin, or front porch, as he must remain clean for his police social visits.

Car type

A criminal network takes orders for specific makes and models for criminal use or chop shop to legitimise stolen cars. He often gets a list of cars to look for.

He believes the information he collects is the first stage of identifying a home invasion prospect to get the car keys as they need a clean car. Be aware that some criminals now use tow trucks to remove a car if they can’t easily get the keys.

Dumpster diving and mailbox theft

Lenny gets a bonus if he can retrieve any original utility bills, bank statements, ATO bills, etc., with the resident’s name and address. This is the foundation of identity theft.

 With his homeless persona, he does not look out of place, rifling through a wheelie bin. He places a discreet coloured dot nearby to help him avoid raiding the same mailboxes too often.

He is pretty successful, averaging over a dozen pieces of ID a week. Papers go in a hollow ‘drop brick’ in a local building.

Patterns and routines mean criminal opportunities

Regular patterns of absence for things like shopping are helpful to local gangs. Cybercriminals use this to build behaviour patterns that AI may use to fabricate a convincing scam.

Family names and demographics

All help build a more complete dark web profile.

QR-codes

Lenny places fake QR codes, cheap drink offers, and job offer scam sheets when he finds them in the ‘drop brick’.

What can you do to protect yourself from cybercriminals and criminal gangs?

  • Google Maps Street View: You can request Google to blur your home. See Google Support, as this may reduce your chances of becoming a target.
  • Put a lock on your mailbox – it reduces mail theft. Get all bills and documents via email.
  • Get a lock box for the electricity meter with a glass panel to allow meter readings. This also reduces the incidence of home invasion if you go outside to investigate a power outage.
  • Install security cameras and alarms.
  • Install three-point lock security doors and screens.
  • Install smart lights inside the home that randomly switch on when you are out to make the home look occupied.
  • Porch bandits are well-organised and fast-acting. Send parcels to an Australia Post Parcel Locker (if by Australia Post or Startrack) or try to make arrangements with a local shop to act as your parcel address—a gold coin in appreciation is usually enough.
  • Dumpster diving is successful because people are too lazy to remove bills and more, which is gold for ID Theft. Buy a good cross shredder from Officeworks.
  • QR code scams are now at epidemic level (guide) will help you avoid fake QR scams.
  • Don’t overshare on social media. AI now monitors targets on social media, looking for personal information like holidays, children’s/pets’ names, birthdays, and much more.

Cars and bikes are juicy targets

  • Bikes, especially e-bikes, on the porch or in carports. A bike lock is no obstacle for a bolt cutter.
  • If you park on the street or in a carport, your car will be more likely to be a target. The best measure is an anti-theft tyre wheel clamp (not a steering wheel lock), as this can slow a thief down and is enough to make them look for easier targets. Place a security camera nearby with a motion alarm. Consider a lockable car cover and GPS tracking.
  •  Prevent number plate theft using theft-resistant screws or PROLOK Pentaforce screws.

CyberShack’s view: Cybercriminals, even local criminal gangs, need boots on the ground

Lenny is one of ‘who knows how many’ watchers. The scary part is that this is organised by an AI-driven app and orchestrated on a large Australia-wide scale. Watchers are the lowest rung on the crime ladder. Technically, apart from mailbox theft, they are not breaking the law by dumpster diving or casually observing you or your home.

I asked if he had ever been caught or compromised. “Nah, mate. Only druggies take stupid risks. There are plenty of safe opportunities.”

As Dorothy said in The Wizard of OZ, “Toto, I have a feeling we’re not in Kansas anymore.” This pretty well describes the world we live in today.

Brought to you by CyberShack.com.au