For 30 days, another criminal's infostealer recorded the workstation of a fraud ring in Bangladesh that calls itself RHTiT. We found it while reverse-engineering that malware. The captures show how the group cleared Kraken's identity checks and opened accounts at Chime and Cash App.
There was no exploit. Every check had a rented answer, and the group bought all of them.
Why KYC failed: every check had a rented answer
Know Your Customer (KYC) verification asks three questions when someone opens an account online. RHTiT paid for an answer to each one.
- Is the identity real? Real stolen US identity records bought in bulk, plus passport templates and portraits edited to match
- Is a real person present? Cloud phones able to substitute camera input with prepared media (assessed with moderate confidence; no direct capture of a successful bypass)
- Does the device and connection look normal? Cloud Android phones with mobile hardware identifiers, routed through residential proxies in the identity owner's state
They weren't selling accounts. They were selling trust
The group's product was a cleared account, not stolen funds. Kraken accounts verified to a higher tier were logged in the team ledger and sold in batches. One row reads "50k limit Sold."
That is the part KYC teams should sit with. Once an account clears verification, every control after it assumes the customer is real. RHTiT was selling that assumption.
What fraud and KYC teams should look for
Three signals we would start with (our recommendations, not controls we saw tested at a specific platform):
- Locations that are too perfect. A proxy matched to the identity's state looks right for one account. Across many new accounts, the same proxy providers and similar device profiles stand out.
- 2FA that behaves like a team. Shared TOTP secrets mean one account's codes get entered from changing devices and places.
- Post-approval behaviour. A test deposit and withdrawal, then an email or phone change soon after approval, fits the resale pattern.
Read the full report
The full report breaks the operation into six stages, from buying identities to reselling verified accounts, with 16 redacted workstation captures.
CA-20260921-001_Industrialized_Cloud_KYC_Farm-v2.pdf
If you run KYC or fraud at an exchange, neobank or fintech and want to talk through these signals, contact our research team.
Want to detect threats 8+ months earlier?
See how DarkArmor's PreBreach intelligence can protect your organization.
