Spear-phishing run tricks users to transfer money (TTPs & IOC)

blog.redteam.pl 4 lat temu

We are publishing the following information in order to aid organisations to identify this threat before attackers will execute successful phishing on their employees. Attackers are targeting companies which have abroad trading partners, i.a. in Asia, to execute a wire transfer to a incorrect bank account number.

We found that domains registered utilizing muhammad.appleseed1@mail.ru email address are actively utilized in a spear phishing run that aims to trick targets to transfer money into bank accounts controller by the attacker utilizing social engineering.

Most likely attack script looks like following:

There is an ongoing email communication between company X and Y
An attacker has gained access to an email account of 1 of the parties
Sends an email message from a typosquatted domain utilizing old correspondence content in order to deliver advanced quality spear phishing attack
After that both employees of company X and Y start to exchange e-mails straight with the attacker
The attacker provides fake invoice details (new bank account number for wire transfers)
For additional assurance and most likely to hold detection the attacker besides sends a fake bank wire transfer confirmation.

Attackers utilized Nitro PDF to modify wire transfer confirmations (information based on metadata). Most of the phishing domains are registered in publicdomainregistry.com. message servers utilized in attacks are from *.mailhostbox.com. The following headers can be found in the phishing e-mails:

References: <*@*.i.mail.ru>

In-Reply-To: <*@*.i.mail.ru>

Received: from localhost (unknown [104.254.98.2])

Received: from us2-ob1-4.mailhostbox.com (162.210.70.57)

Domain name servers (NS) are from *.orderbox-dns.com and fake domains can besides be identified by requesting SOA record:

$ host -t soa chinafoodlng.com

chinafoodlng.com has SOA evidence monovm.mars.orderbox-dns.com. muhammad.appleseed1.mail.ru. 2020061602 7200 7200 172800 38400

E-mail address utilized by an attacker for domain registration is utilizing Nigerian (+234) telephone number starting with +2348087, which was discovered utilizing mail.ru password reminder functionality for the attacker email address: