Phishing Kit Targets Apple and Amazon Customers and Other News

16Shop Phishing Kit Targeting Apple and Amazon Customers

The 16Shop phishing kit has been targeting Apple customers lately, phishing for financial information about victims. This kit is offered for sale on various marketplaces, and also has an active social media presence. The Facebook support group for this tool has over 200 members. The actors behind this tool have also released a new kit that focuses on targeting Amazon customers in a similar manner.

Recommendations

• Enable multi-factor authentication for all accounts to prevent potential account takeover.
• Always verify the sender of suspicious emails.
• Never download attachments from unknown senders or suspicious email.
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed.

Details

Campaigns leveraging the 16Shop phishing kit have been spotted in the wild targeting Apple customers in the US and Japan. The kit can be used to generate and send phishing emails, as well as spin up the actual phishing website. In this campaign, potential victims receive emailed intended to look as though they are from Apple support. These emails contain PDF attachments, which redirect to a phishing site. The phishing site aims to gather information like name, birth date, phone number, and credit card details from victims.

16Shop is offered for sale on various exploit marketplaces by the author, who goes by the moniker DevilScreaM. This actor is likely involved in the Indonesian Cyber Army hacking group. The kit is also offered for sale on Facebook, in a group used for 16Shop license sales and support. Ths group has over 300 members and 200 posts, and has existed since late 2017.

Additionally, a new kit similar to the existing 16Shop kit has been targeting Amazon customers in a similar manner. Code similarities and social media activity of the suspected actor group behind the tool have led researchers to believe that this tool is also attributable to the 16Shop actors.

IOCs

URLs:
secure2app-accdetall1.usa.cc.servsdlay[.]com/?16shop
gexxodaveriviedt0[.]com/app1esubm1tbybz/?16shop
gexxodaveriviedt0[.]com/secur3-appleld-verlfy1/?16shop
sec2-accountdetail.accsdetdetail[.]com/?16shop
verification-amazonaccess.secure.dragnet404[.]com/
verification-amazon.servicesinit-id[.]com/
verification-amazonlocked.securesystem.waktuakumaleswaecdvhb[.]com/
verification-amazonaccess.jaremaubalenxzbhcvhsd[.]business/
verification-amazon.3utilitie[.]com/
verification-amaz0n[.]com/

Hashes:
34f33612c9f6b132430385e6dc3f8603ff897d34c780bfa5a4cf7663922252ba
b43c2ba4e312d36a1b7458d1342600957e0daf3d1fcd8c7324afd387772f2cc0
569612bd90de1a3a5d959abb12f0ec66f3696113b386e4f0e3a9face084b032a
d9070e68911db893dfe3b6acc8a8995658f2796da44f14469c73fbcb91cd1f73

Breaking News - 07.17.2019

New Android Attack Allows Unauthorized Access to Loudspeaker Data

A novel attack against Android devices has been discovered by a team of researcher. Successful use of this method could allow an attacker access to a device's loudspeaker. This would grant access to any calls taken over speakerphone, voice notes received by the device, as well as multimediia played over the speaker.

See the full report here: https://thehackernews.com/2019/07/android-side-channel-attacks.html

Turla Actor Updates Attack Methods

Turla, a Russian-speaking threat actor group, has recently updated its attack vectors. One of the new tools, a piece of .NET malware named Topinambour, is used to build a fileless RAT such that it can evade detection. Other new tools include malware called RocketMan and MiamiBeach.

See the full report here: https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/

GandCrab Decryption Keys Released Publicly

The FBI has published decryption keys for the GandCrab ransomware family. Victims of these versions of GandCrab will be able use these keys to recover their files, making the ransomware family much less of a threat. This comes shortly after the June 1, 2019, announcement by the developers that GandCrab was shutting down operations.

See the full report here: https://www.darkreading.com/attacks-breaches/fbi-publishes-gandcrab-decryption-keys/d/d-id/1335258