Threat Intelligence Bulletin: 11/19/2021 - 11/25/2021

Phishing Ecosystem Series: Victim Workflow and Data Exfiltration

Phishing campaigns will have many different TTPs based on the vertical or brand being targeted. Phishing designed to obtain credentials for retail brands or marketplaces can contain very different stages compared to phishing designed to obtain online banking or credit card information from victims.

While campaigns and phishing kits can vary dramatically, typically the victim workflow and data exfiltration methods remain consistent across attacks, based on vertical being targeted. In this advisory we will cover some of the typical behaviours associated with more popular types of phishing kits.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts.
• Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
• Avoid opening unsolicited attachments and never click suspicious links
• Do not share passwords, and do not reuse the same password on different websites and applications.
• If you are alerted or suspect a compromised account, change the password immediately.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.

Details

A good indicator of the behaviours involved in a phishing attack can be inferred from understanding the type of phishing kit being used. In an earlier post in this series we outlined these types and how they function. Additionally to this, victim data exfiltration methods can be closely tied with the type of kit, as the more complex a kit’s victim workflow may have, the more options the operator will have for collecting victim data.

Figure 1: An example of the structural differences between a basic kit (left), and more advanced commercial kit (right).
Source: ZeroFox Threat Research

Basic kits have a very linear victim workflow (A victim workflow refers to the steps the victim of a phishing attack will follow when interacting with a phishing page). As the underlying code offers no additional functionality outside of presenting a login form and collecting the input data, the data requested from the victim will be quite basic such as username and password. These kits are designed only to collect basic data and sets of credential pairs, so the verticals or brands they target tend to be retail or consumer-based brands. For example, online marketplaces, subscription based services, music and video streaming platforms make up the bulk of targeted platforms. They are ideal targets for these kits, as many of the platforms only require a username and password to log in with two-factor authentication or MFA being optional and still not widely enforced.

Figure 2: A basic phishing page prompting for a username and password. Clicking on social network authentication prompts presents the victim with other phishing pages impersonating the selected social network.
Source: ZeroFox Threat Research

With these basic requirements, the victim workflow will consist of one or more simple login pages, with the victim being redirected to the legitimate website the phishing attack was impersonating once the input has been submitted. Behind the scenes credentials will be logged locally, such as to a text file which sits on the web host hosting the phishing page, as well as potentially being emailed to the threat actor who deployed the phishing page.

Figure 3: Source code from a phishing kit, sending victim credentials to the configured exfil/dropper email address.
Source: ZeroFox Threat Research

Commercial or “Phishing-as-a-Service” kit authors will produce kits targeting many brands or verticals, but reuse a lot of code and assets between them. These phishing kits can cost threat actors, in some cases, several hundred USD to purchase- and to justify this cost their capabilities are far more advanced than typical basic kits. Workflows will vary between the targeted brand, and be customisable by the threat actor deploying the phishing kit.

With the increased vigilance of anti-fraud checks from both banks and online vendors, threat actors also adapted their techniques and tools to extract more sensitive information from victims to facilitate bypassing “know your customer” (KYC) checks. Many of the latest phishing kits now include additional stages in the victim workflow to prompt the victim to provide identity documentation. Requested information can range from a single “selfie” photo, to photos of their passport or driver's license, which in combination with other victim data can be used for fraudulent purposes.

Figure 4: Phishing page requesting the user to upload identity documents
Source: ZeroFox Threat Research

For exfiltrating victim data, writing to a local text file or emailing the operator always remains a standard and popular choice, however, many of these kits have extra features in order to notify operators or securely exfiltrate victim data in case a web host is taken down or a dropper email address is closed. Telegram and other encrypted messaging apps are commonly used as the platforms support forms of automation with the use of bots or scripts which can be created to easily collect and send data elsewhere.

Figure 5: Source code from a phishing kit, sending victim data via a Telegram bot to a private chat operated by the threat actor.
Source: ZeroFox Threat Research

One of the more complex types of victim workflows stem from the use of puppeteer kits. These kits are specifically designed to phish for online banking credentials and other sensitive information from individuals whilst impersonating popular financial institutions. The workflow is bespoke, as the operator manually dictates what questions the victim is asked, what data should be collected, and how long they even have to wait between each form to be presented to them.

Figure 6: Victim view (left), being prompted to provide specific characters from their memorable word. Operator view (right), selecting which characters are required based on prompts from the legitimate online banking platform.
Source: ZeroFox Threat Research

At each stage of the workflow, after the victim has entered the requested details, the threat actor operating the kit will immediately take that data and use it to directly log in to the legitimate online banking platforms, effectively “man-in-the-middle”-ing the login process. Any security questions, two-factor authentication, or MFA prompts they may receive are simply forwarded to the victim via the phishing kit.

Victim data and other other sensitive information is stored within a database on the back end. This database does not need to exist on the same host as the actual phishing page, so as sites may be taken down and access may be lost to a web host, victim data is still held elsewhere for the threat actor to collect or later sell on.

Conclusion

Phishing kits continue to adapt their capabilities based on security advances for online platforms, and as login processes change. It is within phishing kit authors and operators best interests for these phishing attacks to be believable as possible, and mirror the legitimate process- whilst also being flexible enough to trick victims into providing more data than may typically be requested. This can be done through a combination of believable victim workflows and phishing lures, pressuring the potential victim into providing their information quickly, before something negative may happen to their account. Similarly, as vendors improve anti-abuse processes such as closing email accounts associated with phishing, threat actors pivot to new platforms to host their infrastructure which do not have such robust processes.

Breaking News: 2021-11-19 - 2021-11-25

Millions of Sky routers left open to hackers for 18 months - The Independent

Millions of Sky routers suffered from a vulnerability that would have allowed a customer’s home network to be compromised by hackers. Researchers from Pen Test Partners discovered that a DNS rebinding error, which allows an attacker to bypass defenses in web browsers, meant that users with the default administrator password were left unprotected.

See the full report here: https://www.independent.co.uk/life-style/gadgets-and-tech/sky-routers-hackers-fix-update-b1960817.html

Credit card skimmer found at Southern Utah gas pump leads to the arrest of 2 - St George News

A Las Vegas couple was arrested after deputies investigating an alleged card skimming report found the pair sitting in the backseat of a vehicle near Gunlock Road in Washington County on Wednesday morning. Washington County Sheriff’s deputies responded Wednesday to a fraud reported at one of the gas stations in Veyo involving a credit card skimmer that had been placed in a credit card reader at one of the gas pumps, according to the probable cause statements filed in support of the arrests.

See the full report here: https://www.stgeorgeutah.com/news/archive/2021/11/19/cgb-credit-card-skimmer-found-at-southern-utah-gas-pump-leads-to-the-arrest-of-2/

Teen Hacker Arrested for Stealing $36 Million in Cryptocurrency - Futurism

A Canadian teenager was arrested this week after allegedly stealing roughly $36.5 million worth of cryptocurrency from just one individual based in the US. According to police, it’s currently the biggest cryptocurrency theft reported from one person.

See the full report here: https://futurism.com/the-byte/teen-hacker-arrested-stealing-cryptocurrency

Utah medical center hit by data breach affecting 582k patients - BleepingComputer

Utah Imaging Associates (UIA), a Utah-based radiology center, has announced a data breach affecting 582,170 people after their personal information was exposed. According to the data breach notification sent to affected individuals, the security incident was discovered on September 4, 2021, and was remediated on the same day. However, the initial network infiltration happened on August 29, 2021, allowing the threat actors to explore UIA's internal systems and potentially steal data for about a week.

See the full report here: https://www.bleepingcomputer.com/news/security/utah-medical-center-hit-by-data-breach-affecting-582k-patients/

Suspected Chinese Cyber Espionage Campaign Breached Nine and Targeted 370 Critical Organizations - CPO Magazine

Palo Alto Networks Unit 42 researchers discovered that a hacking group with ties to China breached at least nine organizations in a global cyber espionage campaign. The report indicated that attackers indiscriminately targeted about 370 organizations in the defense, healthcare, education, technology, and energy sectors. According to the researchers, hackers targeted organizations running vulnerable Zoho servers and compromised at least one entity in the United States.

See the full report here: https://www.cpomagazine.com/cyber-security/suspected-chinese-cyber-espionage-campaign-breached-nine-and-targeted-370-critical-organizations/

Microsoft Authenticator gets new enterprise security features - BleepingComputer

Microsoft has added new security features for Microsoft Authenticator users that further secure the app and make it easier to roll out in enterprise environments. By enabling number matching in Microsoft Authenticator push notifications and the additional context in requests, admins will improve user sign-in security across the organizations. They can also make use of Conditional Access policies to restrict access to corporate resource access to a specific geographic area with the help of Microsoft Authenticator GPS location info.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-authenticator-gets-new-enterprise-security-features/

US Banks Will Be Required to Report Cyberattacks Within 36 Hours

Under a new cybersecurity incident notification rule, banks in the United States will be required to notify federal regulators of any cybersecurity incidents within 36 hours of discovering them. The rule takes effect April 1, 2022, although enforcement will not begin until May 1. The Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System, and the Office of the Comptroller of the Currency (OCC) announced the final version of the Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers on Nov. 18.

See the full report here: https://www.darkreading.com/risk/u-s-banks-will-be-required-to-report-cyberattacks-within-36-hours

Some Tesla owners unable to unlock cars due to server errors - BleepingComputer

Some Tesla owners worldwide are unable to unlock or communicate with their cars using the app due to an outage of the company's servers. Tesla owners have taken to social media reporting that the Tesla app is returning a "500 server error" when attempting to communicate with the car. This outage prevents owners from using the app to get into the car and it reports an incorrect location of the car.

See the full report here: https://www.bleepingcomputer.com/news/technology/some-tesla-owners-unable-to-unlock-cars-due-to-server-errors/

North Korean Hackers Found Behind a Range of Credential Theft Campaigns

A threat actor with ties to North Korea has been linked to a prolific wave of credential theft campaigns targeting research, education, government, media, and other organizations, with two of the attacks also attempting to distribute malware that could be used for intelligence gathering. Cybersecurity researchers attributed the infiltrations to a group it tracks as TA406, and by the wider threat intelligence community under the monikers Kimsuky (Kaspersky), Velvet Chollima (CrowdStrike), Thallium (Microsoft), Black Banshee (PwC), ITG16 (IBM), and the Konni Group (Cisco Talos).

See the full report here: https://thehackernews.com/2021/11/north-korean-hackers-found-behind-range.html

Microsoft Exchange servers hacked in internal reply-chain attacks - BleepingComputer

Threat actors are hacking Microsoft Exchange servers using ProxyShell and ProxyLogon exploits to distribute malware and bypass detection using stolen internal reply-chain emails. Cybersecurity researchers have discovered an interesting tactic used of distributing malicious email to a company's internal users using the victim's compromised Microsoft exchange servers. The actors behind this attack are believed to be 'TR', a known threat actor who distributes emails with malicious attachments that drop malware, including Qbot, IcedID, Cobalt Strike, and SquirrelWaffle payloads.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-in-internal-reply-chain-attacks/

US SEC warns investors of ongoing govt impersonation attacks - BleepingComputer

The Securities and Exchange Commission (SEC) has warned US investors of scammers impersonating SEC officials in government impersonator schemes via phone calls, voicemails, emails, and letters. Investors are advised not to provide personal info until they verify they're actuating speaking with an SEC official since these phone calls and voicemails are "in no way connected to the SEC."

See the full report here: https://www.bleepingcomputer.com/news/security/us-sec-warns-investors-of-ongoing-govt-impersonation-attacks/

As digital shopping surges, researchers predict 8 million daily attacks

Arkose Labs released new data on the latest fraud trends, revealing increased threats during the holidays, rising bot attacks, and a resurgence in attacks on travel companies. As shoppers fill their online carts, account takeover (ATO) attacks and gift-card fraud remain persistent. Retail and travel attacks increased 63 percent in Q3, and gaming saw a spate of fake new accounts being set up for fraudulent purposes.

See the full report here: https://www.helpnetsecurity.com/2021/11/22/threats-during-holidays/

Hackers Target Phones of Small Crypto Investors - pymnts.com

A Wall Street Journal (WSJ) report says that hackers are stealing cryptocurrency more often from random individual users. Hackers have traditionally stolen from wealthy or well-known investors via SIM swaps or switching a phone number from one device’s subscriber identity to another, but they are increasingly using these methods to steal from lower-profile individuals.

See the full report here: https://www.pymnts.com/news/security-and-risk/2021/hackers-target-phones-of-small-crypto-investors/

Android Users Beware! New PhoneSpy Malware Steals Sensitive Info, Uninstalls Security Apps - Tech Times

Android users beware of the new PhoneSpy malware, which some security experts have already warned that could steal sensitive info from its victims. This time around, the security firm that goes by the name Zimperium zLabs warned Android mobile users that about 23 malicious apps are now carrying the latest spyware on the mobile OS of Google.

See the full report here: https://www.techtimes.com/articles/268323/20211121/android-users-beware-new-phonespy-malware-steals-sensitive-info-uninstalls.htm

Hackers hit Iran's Mahan airline, claim confidential data theft - BleepingComputer

Mahan Air, a privately-owned airlines company in Iran, has announced a cybersecurity incident that has resulted in its website going offline and potential data loss. All international and domestic flights are running as usual without changes or delays, even though access to the company website was affected. The company claims that the attack has been thwarted successfully and in a short time.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-hit-irans-mahan-airline-claim-confidential-data-theft/

Wind turbine giant Vestas' data compromised in cyberattack - BleepingComputer

Vestas Wind Systems, a leading wind-turbine manufacturing company, has shut down its IT systems across several business units after a cyberattack. Some factories of Vestas were forced to slow down production, and some data has been compromised. The firm has stated that the impact on manufacturing, construction, and service has been minimal.

See the full report here: https://www.bleepingcomputer.com/news/security/wind-turbine-giant-vestas-data-compromised-in-cyberattack/

Imunify360 Bug Leaves Linux Web Servers Open to Code Execution, Takeover

A high-severity security vulnerability in CloudLinux’s Imunify360 cybersecurity platform could lead to arbitrary code execution and web-server takeover, according to researchers. The bug exists in the Ai-Bolit scanning functionality of the Imunift360, which is used to search for viruses, vulnerabilities and malware code. Imunify360 users should upgrade to the latest version of the platform, which contains a patch.

See the full report here: https://threatpost.com/linux-web-servers-imunify360-bug/176508/

Devious ‘Tardigrade’ Malware Hits Biomanufacturing Facilities

The Bioeconomy ​​Information Sharing and Analysis Center (BIO-ISAC) revealed the ongoing effort, which involves a type of malware labeled “Tardigrade” that was first detected following a ransomware attack on an unnamed major biomanufacturing facility this spring.The same malware was found at a second biomanufacturing facility last month, leading to the release of the information Monday in an effort to raise awareness among other companies in the sector to step up their cybersecurity efforts.

See the full report here: https://www.wired.com/story/tardigrade-malware-biomanufacturing/

UK govt warns thousands of SMBs their online stores were hacked - BleepingComputer

The UK's National Cyber Security Centre (NCSC) has warned the owners of more than 4,000 online stores that their sites were compromised in Magecart attacks to steal customers' payment info.Magecart is an umbrella term encompassing several different threat groups who all use the same attack method: They compromise e-commerce websites to inject card-skimming scripts on checkout pages, stealing unsuspecting customers' payment card details and other information entered into the fields on the page.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-govt-warns-thousands-of-smbs-their-online-stores-were-hacked/

GoDaddy Breach Exposes SSL Keys of Managed WordPress Hosting Customers

The domain registrar and web hosting company GoDaddy has revealed that it suffered a data breach in which the user data of 1.2m of its customers may have been accessed.According to GoDaddy, the unauthorized person gained access to its systems around September 6 by using a compromised password. However, it wasn't until last week on November 17 that the company discovered the breach.

See the full report here: https://www.darkreading.com/attacks-breaches/godaddy-breach-exposes-ssl-keys-of-managed-wordpress-hosting-customers

Exploit released for Microsoft Exchange RCE bug, patch now - BleepingComputer

A security researcher has published proof-of-concept exploit code for a high-severity vulnerability (CVE-2021-42321) impacting Microsoft Exchange servers. It allows authenticated attackers to execute code remotely on vulnerable Exchange servers. The bug was patched by Microsoft during the November Patch Tuesday.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-released-for-microsoft-exchange-rce-bug-patch-now/

Apple Sues Israel's NSO Group for Spying on iPhone Users With Pegasus Spyware

Apple has sued the NSO Group and its parent company Q Cyber Technologies in a U.S. federal court, holding it accountable for illegally targeting users with its Pegasus surveillance tool. The lawsuit also seeks to permanently prevent the company from breaking into any Apple software, services, or devices.

See the full report here: https://thehackernews.com/2021/11/apple-sues-israels-nso-group-for-spying.html

Researchers Detail Privilege Escalation Bugs Reported in Oracle VirtualBox

A vulnerability affecting Oracle VM VirtualBox could be exploited to compromise the hypervisor. It can lead to a hang or frequently repeatable crash (complete DoS) of Oracle VM VirtualBox. The flaw affects all versions of the product prior to 6.1.24. VirtualBox installations should be updated to the latest versions, which contain the patch.

See the full report here: https://thehackernews.com/2021/11/researchers-detail-privilege-escalation.html

Over nine million Android devices infected by info-stealing trojan - BleepingComputer

Huawei's AppGallery was hit by a malware campaign which has led to approximately 9,300,000 installs of Android trojans masquerading as over 190 different apps. Huawei AppGallery is a package manager and application distribution platform for the Google-developed open-source Android operating system and Huawei's HarmonyOS.Researchers at Dr. Web AV have detected this trojan and is designed to collect sensitive user data.

See the full report here: https://www.bleepingcomputer.com/news/security/over-nine-million-android-devices-infected-by-info-stealing-trojan/

Microsoft Edge adds Super Duper Secure Mode to Stable channel - BleepingComputer

Microsoft Edge has added a "Super Duper Secure Mode" to the web browser, which brings security improvements without significant performance losses. Users can enable this mode after upgrading Edge to stable version 96.0.1054.29 or later. They can toggle between Balanced and Strict modes for different levels of security.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-edge-adds-super-duper-secure-mode-to-stable-channel/

Holiday Scams Drive SMS Phishing Attacks

Security firm Proofpoint stated that the volume of short message service (SMS) phishing has almost doubled from the same period in the prior year as the holiday seasons are approaching. SMS phishing is only the initial attack vector. Many attackers install malware on target devices after a successful compromise.

See the full report here: https://www.darkreading.com/threat-intelligence/holiday-scams-drive-sms-phishing-attacks

Researchers warn of severe risks from ‘Printjack’ printer attacks - BleepingComputer

A group of Italian researchers has come up with a set of three attacks called 'Printjack,' warning users of the significant consequences of over-trusting their printer. The attacks include recruiting the printers in DDoS swarms, imposing a paper DoS state, and performing privacy breaches.

See the full report here: https://www.bleepingcomputer.com/news/security/researchers-warn-of-severe-risks-from-printjack-printer-attacks/

New Android Spyware Variants Linked to Middle Eastern APT

Sophos researchers have reported new variants of Android spyware linked to a Middle Eastern advanced persistent threat (APT) group that is stealthier and more persistent. According to the researchers, this malware appears as an app update with a generic icon and name. This is believed to be distributed as a download link in a text message sent to the victim's phone.

See the full report here: https://www.darkreading.com/threat-intelligence/new-android-spyware-variants-linked-to-middle-eastern-apt

Attackers Actively Target Windows Installer Zero-Day

Even though the Windows Installer vulnerability was patched in the patch Tuesday notes of November, security researcher Abdelhamid Naceri discovered a Windows Installer elevation-of-privilege vulnerability that could be actively exploited by the attackers. The researcher posted a proof of concept (POC) exploit Tuesday on GitHub for the newly discovered bug.

See the full report here: https://threatpost.com/attackers-target-windows-installer-bug/176558/

Supernus Pharmaceuticals Targeted in Ransomware Incident | Your Money | kulr8.com - KULR-TV

Supernus Pharmaceuticals is a biopharmaceutical company focused on developing and commercializing products for the treatment of central nervous system (CNS) diseases. The firm has disclosed that it was the recent target of a ransomware attack. The Company believes that the criminal ransomware group encrypted certain files on the Company’s systems and had deployed malware to impede access to the Company’s systems. No ransom payments have been made by the Company.

See the full report here: http://globenewswire.com

Ransomware attack shuts down Lewis and Clark Community College campuses - KSDK.com

Lewis and Clark Community College experienced a ransomware attack late on Tuesday, Nov. 23, which has led to a shutdown of all its campuses. All systems have been taken offline in the meantime to prevent any further issues. IT teams are working on investigating the extent of the issue.

See the full report here: https://www.ksdk.com/article/news/education/lewis-and-clark-community-college-ransomware-attack/63-31ca6afa-5667-4b63-9718-c007941eb0ec

Data breach hits retailer S&R - INQUIRER.net

S&R Membership Shopping suffered from a data breach that has exposed confidential, sensitive, or protected information of about 22,000 customers to unauthorized persons. The upscale retailer informed the public through an advisory more than a week after the incident. No further information regarding the breach was reported by National Privacy Commission (NPC).

See the full report here: https://business.inquirer.net/334986/data-breach-hits-retailer-sr

NYC man charged with hacking into Wegmans customer accounts, placing fraudulent orders - Fox Business

According to the Department of Justice, a New York City resident is being charged with hacking into 59 Wegmans Food Market customer accounts and placing $10,000 in fraudulent orders. The Wegmans website is used to order flowers, office supplies, and home decorations, in addition to food.

See the full report here: https://www.foxbusiness.com/economy/new-york-city-man-charged-with-hacking-into-wegmans-customer-accounts-placing-10000-in-fraudulent-orders

School board Zoom meeting hacked - The Star - The Star of Grand Coulee

Hackers disrupted the Grand Coulee Dam School District’s board meeting Monday night as “trolls” who logged onto the Zoom meeting. Superintendent Paul Turner, along with the district’s board of directors, held the meeting in the school library while others attended via ZOOM. Turner told The Star on Tuesday that he did speak with the IT department and was told that when a Zoom meeting is held in an “open session,” allowing people to simply log onto the meeting, there isn’t much you can do about it.

See the full report here: https://www.grandcoulee.com/story/2021/11/24/news/school-board-zoom-meeting-hacked/14776.html