Trio accused of using deepfake CEOs and Trio to scam businesses out of $129 million
Trio has been convicted or has pleaded guilty in a case brought by FBI.
Trio has been convicted or has pleaded guilty in a case brought by FBI.
Three men allegedly used deepfakes of company CEOs and law firm attorneys to trick employees into wiring more than $129 million to accounts the group controlled, the Justice Department said.
The indictment names the three as Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42.
A member of the conspiracy, impersonating one of those lawyers, would ultimately direct the employee to wire a large sum of money in furtherance of that sham financial transaction to a particular bank account, which was in fact controlled by members of the conspiracy, they added.
Hazan is not a new face to prosecutors, since he was already convicted of conspiracy to commit bank fraud in the Southern District of New York in 2008.
41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, according to Gartner, and 36% said the same about video calls.
Past victims of Trio are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.
The scheme ran from 2024 to 2026 and usually opened with someone posing as the victim company’s chief executive, using AI to mimic the executive’s voice or image on calls.
He kept a handwritten script titled Lawyer Call to help him sound like the genuine article, and it included lines meant to keep victims from discussing the calls with their colleagues.
An arrest or a seized domain disrupts the operation, but it doesn't undo what already happened to that operation's past victims, and it rarely accounts for every affiliate who can simply rebrand.
The victims named in the indictment range from healthcare to finance.
The largest single loss listed, $11.6 million, hit a UK financial technology company, while a Florida pet food company lost $5.2 million.
This action was brought by FBI, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.
Trio is now dealing with a resolved criminal case, with FBI leading the action.
If your environment shows any indicators associated with Trio, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.
Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.
What happened
Trio has been convicted or has pleaded guilty in a case brought by FBI.
Three men allegedly used deepfakes of company CEOs and law firm attorneys to trick employees into wiring more than $129 million to accounts the group controlled, the Justice Department said.
The indictment names the three as Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42.
What changed
A member of the conspiracy, impersonating one of those lawyers, would ultimately direct the employee to wire a large sum of money in furtherance of that sham financial transaction to a particular bank account, which was in fact controlled by members of the conspiracy, they added.
Hazan is not a new face to prosecutors, since he was already convicted of conspiracy to commit bank fraud in the Southern District of New York in 2008.
41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, according to Gartner, and 36% said the same about video calls.
Who is affected
Past victims of Trio are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.
The scheme ran from 2024 to 2026 and usually opened with someone posing as the victim company’s chief executive, using AI to mimic the executive’s voice or image on calls.
He kept a handwritten script titled Lawyer Call to help him sound like the genuine article, and it included lines meant to keep victims from discussing the calls with their colleagues.
Why it matters
An arrest or a seized domain disrupts the operation, but it doesn't undo what already happened to that operation's past victims, and it rarely accounts for every affiliate who can simply rebrand.
The victims named in the indictment range from healthcare to finance.
The largest single loss listed, $11.6 million, hit a UK financial technology company, while a Florida pet food company lost $5.2 million.
Technical details
This action was brought by FBI, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.
Response
Trio is now dealing with a resolved criminal case, with FBI leading the action.
What security teams should do
Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.
What remains unknown
The exact number of companies affected by the scheme is not specified.
Details on how the deepfake technology was acquired or developed are not provided.
The current status of the legal proceedings against the accused is not detailed.