Actor Profile: Cazanova Haxor is Back At It

Actor Profile: Cazanova Haxor is Back At It

Previously, Alpha Team reported on a phishing kit author who goes by the alias Cazanova Haxor. This actor has announced that they are releasing a new kit, targeting American Express customers.

Recommendations

• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Always verify the sender of unexpected or suspicious emails
• Never open attachments or click links in these emails
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

As we've mentioned in the first two reports on this threat actor, phishing kits often spoof financial organizations because the credentials associated with these types of organizations are the most valuable. Other kits released by this author have targeted Netflix and Paypal. Previously, we reported that this actor was operating on a Facebook page, where they advertised kits and posted notices regarding updates. Shortly after the release of that advisory, ZeroFOX sucessfully took down that page.

Following our sucessful takedown, the actor moved operations to a Telegram channel. This is something we have observed occurring more and more often lately, as the social networks have become better at taking down criminal pages.

Figure 1. Announcement of the move to Telgram.

This morning, Cazanova announced that a new kit, dubbed Heroin, would be released within 24 hours. This kit will target American Express customers.

Figure 2. Release announcement of American Express kit on actor's Telegram channel.

At the time of this posting, the kit has yet to be released. This actor generally is not particularly timely with his releases, and so it could be that this kit will be released later than expected. ZeroFOX is actively monitoring this actor, and will provide updates as they are available.