Skozzy

Skozzy is a financially motivated cybercrime actor active in underground criminal ecosystems since at least 2010. The actor has been identified as a carder, a seller of compromised payment card data, and a facilitator of related cybercrime services. Activity attributed to Skozzy also includes spear-phishing operations used to deliver information-stealing malware against financial-sector targets. In observed intrusion activity, Skozzy used socially engineered phishing emails carrying malicious Microsoft Word documents with embedded VBA macros. The lures were crafted to pressure recipients into enabling macro execution, after which the document functioned as a downloader for a second-stage payload. The follow-on malware established persistence, performed host and environment checks, and stole sensitive information including credentials, financial data, communications content, and other victim data. Reported functionality also included keylogging, and the malware was linked to Predator Pain. Operational tradecraft associated with Skozzy includes sender spoofing in phishing emails, use of intermediary mail infrastructure, staged malware delivery, persistence through autorun mechanisms, and exfiltration over common application-layer services. The actor’s known behavior is consistent with financially driven credential theft and data theft operations rather than espionage or disruptive activity.