Newly Reported AiTM Campaign Likely Related to Recent Trends

Context

On August 3, 2022, ZScaler researchers reported the technical details of an adversary in the middle (AiTM) campaign active since at least June 2022. The RH-ISAC team believes, based on timing and nearly identical tactics, techniques, and procedures (TTPs), that this campaign is likely connected to highly similar activity previously reported by Microsoft.

Key findings from ZScaler’s report include:

• Corporate users of Microsoft’s email services are the main targets of this large-scale phishing campaign.
• All phishing attacks begin with an email sent to the victim with a malicious link.
• The campaign is active at the time of blog publication and new phishing domains are registered almost every day by the threat actor.
• In some cases, the business emails of executives were compromised using this phishing attack and later used to send further phishing emails as part of the same campaign.
• Some of the key industry verticals such as FinTech, Lending, Insurance, Energy and Manufacturing in geographical regions such as the U.S., U.K., New Zealand, and Australia are targeted.
• A custom proxy-based phishing kit capable of bypassing multi-factor authentication (MFA) is used in these attacks.
• Various cloaking and browser fingerprinting techniques are leveraged by the threat actor to bypass automated URL analysis systems.
• Numerous URL redirection methods are used to evade corporate email URL analysis solutions.
• Legitimate online code editing services such as CodeSandbox and Glitch are abused to increase the shelf life of the campaign.

RH-ISAC Analysis

The RH-ISAC intel team assesses with moderate confidence that this activity is closely related to the AiTM campaign reported by Microsoft on June 12, 2022. This is based on the time frame of the attacks and similar TTPs, listed here:

• Zscaler researchers found multiple newly registered domains focused on targeting Microsoft mail users.
• Researchers observed that the attacker logged into a lure account, 8 minutes after researchers sent credentials to the attacker’s server.
• Phishing domains in the campaign imitated legitimate financial organizations.
• Phishing emails appeared to come from legitimate email addresses from imitated organizations, indicating that threat actors may have compromised business email accounts to leverage in the attacks.
• Phishing emails contained links either in the body of the email or inside and HTML file attachment.
• Phishing sites were delivered, redirected to, and hosted using diverse methods.
• Using redirects and proxy pages for credential harvesting helped threat actors circumvent multifactor authentication (MFA) protection.

After compromising the lure account, ZScaler researchers observed attackers logging into the account, reading emails, and checking user profile information. This tactic makes it difficult to concretely determine the final motivation of the campaign beyond reconnaissance and account compromise.

IOCs

Researchers at Zscaler reported the following indicators of compromise (IOCs):