Infoblox Threat Intel

Savvy Seahorse

Savvy Seahorse is a DNS threat actor that specializes in investment scams that lure victims into creating accounts on fake investment platforms, making deposits into personal accounts, and then transferring these deposits to a bank in Russia. Savvy Seahorse delivers its campaigns through Facebook advertisements and incorporates fake ChatGPT and WhatsApp bots to urge users to enter personal information. It has spoofed legitimate companies such as Apple, Meta, Mastercard, Visa, and Google for investment opportunities.

Operating since: At least August 2021
Infoblox discovered: August 2022
Infoblox published: February 2024
Prevalence: Uncommon

Threat actor resources

Media Article

Bleeping Computer
February 28, 2024

Savvy Seahorse gang uses DNS CNAME records to power investor scams

A threat actor named Savvy Seahorse is abusing CNAME DNS records Domain Name System to create a traffic distribution system that powers financial scam campaigns.

Report

Infoblox Threat Intel
February 28, 2024

Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads

A persistent investment fraud actor who leverages DNS CNAME records as a traffic distribution system (TDS) to control access to their malicious content spread through Facebook ads.

Blog

Infoblox Threat Intel
February 28, 2024

Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads

DNS threat actors never cease to surprise us. Every day, we learn about creative, new campaigns they have devised to exploit victims. Investment scams are one of these.

Media Article

The Hacker News
March 5, 2023

Retrieving data. Wait a few seconds and try to cut or copy again

A new DNS threat actor dubbed Savvy Seahorse is leveraging sophisticated techniques to entice targets into fake investment platforms and steal funds.

Infoblox Threat Intel

Savvy Seahorse

Threat actor resources

Media Article

Savvy Seahorse gang uses DNS CNAME records to power investor scams

Report

Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads

Blog

Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads

Media Article

Retrieving data. Wait a few seconds and try to cut or copy again

Products

Solutions

Company

Resources

Get Infoblox Email Updates