Alpha Team Threat Update: Prolific Vishing Campaign Targeting New Employees

Summary

ZeroFOX Alpha Team has been assisting industry and threat-sharing partners in tracking a large scale vishing campaign targeting financial institutions, cryptocurrency exchanges, telecommunication companies, and single-sign-on (SSO) providers. The actors target new employees to a company and do an extensive amount of research on the employees and the company to build a convincing persona of an IT contractor working with the victim company. The actors call the victims using this information to serve a phishing site that is tailored for the company, including the company’s SSO portal. Once the victim logs into the phishing portal, the actors set up persistence via additional 2Factor (2FA) devices and then attempt to access VPN software to gain access to internal dashboards. The threat sharing group and Alpha Team assesses that it is probable that these actors and Tactics, Techniques & Procedures (TTPs) were used in the recent hacks on Twitter, resulting in an internal administrative panel being abused to take over high profile Twitter accounts.

Recommendations

• Setup domain monitoring for your company and include your SSO provider (if applicable) to the search terms
• If a domain is found, and it is registered via Namecheap or Shinjiru, escalate immediately for a takedown to the ZeroFOX Team
• Setup impersonation monitoring on LinkedIn for your company to find profiles that are claiming to work for your organization, but are fake
• Setup ZeroFOX Threat Feed to block any domains that match the TTPs of this actor, even if they may not be live, as these are only turned on when used for an attack
• Monitor for additional 2-Factor Authentication applications via your SSO provider on any user, especially if it is not a company-approved application
• Ensure corporate policies dictate to only do IT support calls via approved company video or call conferencing software, and never over the phone
• Setup client-side certificates for endpoints who connect to corporate VPN assets

Details

Vishing, or voice phishing, is a technique where an attacker calls a victim and performs a phishing attack over the phone. The harvesting of victim data can be achieved in different ways, such as the victim surrendering personal details over the phone, but vishing is also an effective way to get the user to visit a malicious website using pretext and social engineering.

ZeroFOX Alpha Team has been assisting industry and threat-sharing partners with an investigation into a large-scale and effective vishing campaign targeting a number of industries. The group has determined that it is probable that these actors and TTPs were used in the recent hacks on Twitter, resulting in an internal administrative panel being abused to take over high profile Twitter accounts.

TTPs

The TTPs of this group involves monitoring for new employees in their list of target industries The industries are as follows:

• Financial institutions and cryptocurrency exchanges linked to high net-worth cryptocurrency influencers
• Telecommunication and mobile companies
• SSO Providers
• Social and digital platforms and code sharing websites

Alpha Team assesses that it is almost certain the actors target these types of industries for account takeover purposes, especially if they can use internal tools or panels to perform these account takeovers.

The actors use Open Source Intelligence (OSINT) via social networks, company listings and announcements to find these employees, as well as collect information about the tools and software the target company uses. For example, if a company has an IT Administrator that lists “Active Directory, Microsoft Teams” within their job profile on social networks, the actors will use this OSINT to build a voice script when interacting with targets in that company. In some cases, actors have registered LinkedIn profiles to connect with employees to gain access to people, information, and announcements directly from the employees.

Figure 1: Fake Profile interacting with new employee, image shared to Alpha Team by partner

The actors will then register a domain using a combination of deceptive keywords and deceptive brands within the domain. The deceptive brand could include the target company or the target company’s SSO provider. The deceptive keywords we’ve seen so far include the following, but are not limited to:

• ticket
• update
• vpn
• employee
• support
• assist
• okta
• login
• sso

The keywords can be plural (such as tickets), as well as contain hyphens (ticket-). Of observed domains, almost all had TLS certificates, typically Let’s Encrypt. The observed domains have mostly been registered with Namecheap and Shinjiru, possibly since they can accept cryptocurrency as payment.

Once a phone call is established with the target victim, the actors use pretext built from their OSINT research to gain the trust of the victim. They pose as a member of the IT team, and instruct them that they are working on a ticket associated with VPN or SSO access. The actor then directs the victim to the phishing site, which is turned “on” only for the attack. This means that they stage domains and pages ahead of the attack, then turn the websites off to avoid being banned from the registrar, or being added to a blacklist. Due to the nature of the domain ecosystem, it is difficult for defenders to determine which domains belong to this actor group, especially with parked pages and search engine optimization from registrars creating these domains in their zone files before they are even bought.

Victims then visit the website, input their credentials, and then their 2FA code, which is replayed to the actors who then login separately to the SSO provider. Once connected, the actors can stage persistence via adding secondary 2FA devices, as well as use the SSO access for a VPN connection to access internal portals and tools.

Alpha Team assesses that these compromises are intended for long term access, so the actors finish the ticket call and then maintain access for some time afterward. They then broker this access and sell it to members of account takeover communities, whether to steal cryptocurrency or for bragging rights.

Conclusion

This style of vishing is effective due to the assumption that a 2FA code can help prevent phishing attacks. If the attack focuses specifically around spear-phishing, where a singular victim is targeted, then 2FA is just as effective as usernames and passwords. A defense-in-depth approach involving training & education, monitoring and pre-emptive blocking of problem domains, SSO auditing, and employing role-based access best practices for internal panels will help mitigate most of the TTPs of this group.