Kr3pto Phishing Kits used in campaign targeting US, UK Financial Institutions

ZeroFOX Alpha Team has recently been tracking the activity of a threat actor known by the alias of “Kr3pto”, who provides services such as authoring, selling and distribution of phishing kits. Kr3pto facilitates the selling of their kits, phished credentials and fullz through Telegram. Multiple kits authored by Kr3pto are being used in an ongoing campaign targeting UK financial institutions and their customers, with Alpha Team obtaining multiple copies of these kits, disrupting hundreds of domains used for the attack and collecting thousands of compromised credentials. Alpha Team assesses with HIGH confidence that Kr3pto will continue to build kits and maintain their presence as a reliable vendor for stolen credentials and financial information on Telegram.

Recommendations

Consider enabling ZeroFOX domain security rules for keywords related to your brand, in order to detect imposter domains. Reach out to [email protected] for assistance if needed
Consider enabling ZeroFOX cyber attack chatter rules to search for terms related to your organization on the dark web and covert communication channels, such as Telegram
If ZeroFOX provides your organization with credentials that were downloaded from vulnerable kits, consider resetting passwords of all victims to prevent account takeover

Details

Phishing kits are pre-packaged scripts and code using standard web app directory structures containing Javascript, CSS and static images stored in separate directories. PHP is used to direct data control flows on the backend server, while jQuery and Javascript are used for dynamic content rendering in the frontend. These kits are designed for ease of use to allow unskilled threat actors to quickly create a phishing site designed to obtain victim credentials, credit card details or other sensitive information.

Threat actors such as Kr3pto provide the cybercrime ecosystem with their skills as kit authors and sell kits through specially designed marketplaces and through negotiation which takes place on Telegram.

Figure 1: Kr3pto sells his pre-made kits and offers to make new ones by request

Figure 2: Patrons of Kr3pto’s Shop use Telegram to Purchase Stolen Credentials and Financial Data

As of October 2020, Kr3pto is actively selling kits targeting multiple banks and financial institutions in the US and UK. In the beginning of October, Alpha Team tracked a large-scale phishing campaign against 2 large UK institutions, targeting customers from those institutions. Alpha Team downloaded dozens of kits used during this campaign and reverse engineered them to provide insight into how Kr3pto kits operate.

These kits contain an administration panel which the threat actor operating the deployment can use to direct the victim through the phishing workflow. These kits are referred to as “puppeteer kits”, as the operator effectively “pulls the strings” in order to extract information from the potential victim including credentials, credit card details and even SMS and OTP tokens.

Figure 3: Admin panel for Kr3pto kits

After reverse engineering the Kr3pto kits, Alpha Team identified vulnerabilities within these deployments that allowed unauthenticated download of victim data, which we subsequently provide to affected customers.

Figure 4: Victim panel for Kr3pto kits

Over the course of the campaign, Alpha Team collected over 1,000 phishing domains, dozens of kits and over 10,000 victim credentials. Alpha Team subsequently collected, analyzed and escalated this information to the affected customers.

Alpha Team assesses with HIGH confidence that Kr3pto will continue building phishing kits for customers. He has expressed that he can build kits on demand. His shop, which is an invite only channel, has over 1,300 members. This could be due to his inventory of kits, fullz and compromised credentials.