Bogus Claim: Google Doc Phishing Worm Student Project

According to internet sources, Eugene Pupov is not a student at Coventry University.

Since the campaign’s recent widespread launch, security experts and internet sleuths have been scouring the internet to discover the actor responsible for yesterday’s “Google Doc” phishing worm. As parties continued their investigations into the phishing scam, the name “Eugene Popov” has consistently popped up across various blogs that may be tied to this campaign.

A blog post published yesterday by endpoint security vendor Sophos featured an interesting screenshot containing a string of tweets from the @EugenePupov Twitter handle claiming the Google Docs phishing campaign was not a scam, but rather a Coventry University graduate student’s final project gone awry.

Source: Sophos News. https://nakedsecurity.sophos.com/2017/05/04/student-claims-google-docs-blast-was-a-test-not-a-phishing-attempt/

Several folks on Twitter, including Twitter verified Henry Williams (@Digitalhen) have pointed out a serious flaw in the @EugenePupov profile.

Source: Twitter, Inc. httpstwitter.com/digitalhen/status/860006167715643392

This twitter account, which fraudulently used a profile image portraying molecular biologist Danil Vladimirovich Pupov from the Institute of Molecular Genetics at the Russian Academy of Sciences, has since been deactivated.

Coventry University’s communications team quickly responded on social media denying all claims that anyone named Eugene Pupov is a current or former student.

Source: Twitter, Inc. httpstwitter.com/CoventryUniNews/status/860120215216148481

Something clearly is “phishy” about this situation.

Despite the university’s recent announcement discrediting claims of enrollment for a Eugene Popov, I would like to hypothetically explore the theory that yesterday’s campaign was a result of a student phishing research project that went terribly viral. Our PhishMe Intelligence teams identified and obtained the campaign source code and noticed that the most notable aspect of this phishing campaign was its uncanny ability to self-replicate and spread. From our vantage, there is no outward evidence indicating data was stolen or manipulated as previously alleged.

The list of domains created for this alleged “student demonstration” stinks like rotten phish.

googledocs[.]gdocs[.]download

googledocs[.]docscloud[.]download

googledocs[.]gdocs[.]win

googledocs[.]gdocs[.]pro

googledocs[.]g-2Dcloud[.]win

googledocs[.]g-2Ddocs[.]win

googledocs[.]g-2Dcloud[.]pro

googledocs[.]g-2Ddocs[.]pro

googledocs[.]docscloud[.]win

As a career-wide security researcher and current leader of phishing intelligence research teams, this list of domains is concerning. Typically, when a researcher is creating proof-of-concept code for a white paper or presentation, the naming conventions adjust the URLs to showcase their malicious or fraudulent nature for education purposes, examples being:

  • “foo-example.com”
  • “evil-mitm-site.com”
  • “hacker.foo.example.com

If the party responsible intended to showcase educational materials that had any potential to unintentionally mislead a victim, they would typically create one, possibly two, examples to help avoid such scenario. A similar example of this would be the puny code phishing sample recently covered in WIRED where the researcher created one puny code example domain.

What’s most concerning here is the number of googledoc look-alike domains. In most best practice scenarios, a legitimate security researcher would not typically register 9 domains to illustrate a point or to educate on a threat vector. This behavior pattern is most noticeably tied to malicious actors with real nefarious motivations behind their actions.

It may be some time before the true motives of the phishing worm author are revealed, however we are inclined to believe there is a very good chance that malicious intent was in development during this campaign, the execution of which snowballed quickly beyond the author’s desired scope.

Cofense CEO Rohyt Belani and CTO Aaron Higbee Named 2017 Tech Titans

Leesburg, VA – May 05, 2017 – PhishMe (cofense.staging.wpengine.com), the leading provider of human-phishing defense solutions, announced today that co-founders Rohyt Belani, CEO, and Aaron Higbee, CTO, have both been named 2017 Tech Titans by Washingtonian magazine. Every two years, the magazine identifies 100 influential people in the Washington, D.C. area technology scene from start-ups to Fortune 500 companies who have made substantial contributions to the community. The list is compiled based on research and interviews conducted between the editors and local technology leaders.

Google Doc Phishing Attack Hits Fast and Hard

Google Doc Campaign Makes a Mark

In the process of managing phishing threats for our customers, our Phishing Defense Center and PhishMe Intelligence teams saw a flood of suspicious emails with subject line stating that someone has “has shared a document on Google Docs with you”, which contained a link to “Open in Docs”. The “Open in Docs” link goes to one of several URLs all within the https://accounts.google.com website.

PhishMe Adds New Modules to CBFree to Help All Organizations Thwart Ransomware and Business Email Compromise

Leesburg, VA – May 3, 2017 – PhishMe (cofense.staging.wpengine.com), the leading provider of human-phishing defense solutions, today announced the availability of five new interactive modules for its complimentary computer-based training (CBT) program, CBFree. Unlike any other security awareness training programs on the market, CBFree is a unique, high-quality, and interactive experience that provides employees with free security awareness training for today’s top cybersecurity threats, including malware and spear-phishing.

April Sees Spikes in Geodo Botnet Trojan

Throughout April, our Phishing Defense Team observed an increase in malicious URLs that deliver the financial crimes and botnet trojan known as Geodo. These emails take a simple approach to social engineering, using just a sentence or two prompting the victim to click on a link to see a report or invoice that has been sent to them.

An example of a typical phishing email used in these attacks is shown below:

Following the malicious links will lead the victim to download a hostile JavaScript application or PDF document tasked with obtaining and executing Geodo malware. One common attribute of these messages is the use of the words “invoice” or “order” as a common substring in the subject lines.

Below are some examples of subject lines we have observed:

Emails containing malicious links providing the PDF documents used to deliver this malware have also been found to contain the word “attachment” somewhere within in the subject line.

When the victim executes the JavaScript application or opens the PDF document, scripting content is used to download and execute the Geodo malware sample. The list below contains a representative sampling of payload locations used to deliver Geodo:

Once the Geodo payload is in place on the victim’s computer, it will connect to the Geodo command and control infrastructure allowing the attacker to collect sensitive information from the infected machine.

Listed below are command and control hosts that have been observed during our analysis:

The core functionality of the Geodo trojan lies in its ability to collect sensitive information from infected machines and their users. Sophisticated browser-based information stealing functionality provided by Geodo includes form grabs and HTTPS man-in-the-middle attacks. Geodo also sports the ability to produce new sets of phishing emails, delivering itself to new potential victims.

Full List of Geodo IOCs collected by the Phishing Defense Center

Infection URLs (Where the malware was originally downloaded from):

Payloads:

Command and Control hosts:

Recommendation:

PhishMe cautions its customers to be wary of emails containing suspicious links or attachments. Specific to this sample, we recommend that customers be observant for unexpected emails that contain subject lines referring to invoices or attachments, and email bodies that ask you to visit a link to see an invoice or report. PhishMe Simulator customers may consider launching simulations that follow this style of attack to further train their users to detect and report suspicious emails.

Want to be notified of the latest malware strains and phishing threats? – sign up for our complimentary PhishMe Threat Alerts service, delivered straight to your inbox.

BEC Scams Hit Technology Giants for over $100 Million Dollars

Even the biggest companies fall for it. This week, reports showed that Business Email Compromise (BEC) scams, sometimes referred to as CEO Fraud Emails, netted over $100 million dollars from Facebook and Google. While people are increasingly aware of phishing emails containing links and attachments, BEC scams (also known as CEO Fraud) continue to reward criminals with alarming effectiveness. These phishing scams fly past traditional security roadblocks because there are no URLs or Attachments to scan.

EY Announces PhishMe CEO Rohyt Belani as Entrepreneur Of The Year 2017 Mid-Atlantic Award Finalist

Tysons, VA, April 25, 2017 – EY today announced that CEO and co-founder Rohyt Belani of PhishMe is a finalist for the Entrepreneur Of The Year® 2017 Award in the Mid-Atlantic region. The awards program, which is celebrating its 31st year, recognizes entrepreneurs who are excelling in areas such as innovation, financial performance and personal commitment to their businesses and communities. Rohyt Belani was selected as a finalist by a panel of independent judges. Award winners will be announced at a special gala event on June 15, 2017 at the Ritz-Carlton, Tysons Corner.

Off-the-shelf Zyklon Botnet Malware Utilized to Deliver Cerber Ransomware

Recent, large-scale distributions of the Zyklon botnet malware mark a continuing trend of off-the-shelf malware use. This multipurpose trojan, capable of supporting numerous criminal activities, has been identified in phishing attacks more and more frequently through the month of April. The bulk of these campaign have leveraged resume- and job-applicant-themed messaging as in the phishing narrative. The most recent analyses of this distribution have shown that the threat actors are attempting to leverage the malware’s full feature set by not only using it as an information stealer, but also as a downloader used to obtain and deploy the Cerber ransomware to infected endpoints. This technique demonstrates threat actor resourcefulness as well as the increasing commodification and democratization of malware utilities once reserved for only the most-technically-capable threat actors.