Microsoft Office
Microsoft Office 365 ATP
Cisco Ironport
Mimecast
By Max Gannon, Dylan Duncan in Cofense Intelligence
Cofense Intelligence has tracked a complex credential phishing operation that evades Microsoft Office 365, Cisco Ironport and Mimecast Secure Email Gateways and has been active since at least December 2019—a very long time for an active credential phishing campaign. The use of a series of convincing tactics suggests that threat actors have taken great effort to create an air of authenticity for targeted recipients. Targeted users receive an email, supposedly from their HR departments, mandating that they complete a SurveyMonkey employee satisfaction survey. The convoluted attack chain uses trusted sources and eventually redirects to a real SurveyMonkey survey, allowing the threat actors to evade detection, and provides recipients with the end results that they expect – a real survey.
This credential phishing chain begins with an email (Figure 1) containing a link to a PDF hosted on the legitimate cloud service provider Hightail. The email itself contains multiple tactics, techniques, and procedures (TTPs) to deceive the end user. These TTPs consist of a seemingly legitimate Hightail spoofed email address ‘delivery @ spaces[.]hightailmail[.]com,’ fronting as a target’s HR department. The email creates a sense of urgency, indicating the survey is mandatory, requires action, only takes a few moments to complete, and will benefit the targeted employee.
Figure 1: Example of one original email sent to targeted recipients
After following the link to Hightail, a PDF is downloaded (Figure 2). Within the PDF, the from, subject, and message fields match the email line-for-line. The URLs for Hightail contain the recipient’s email address encoded in the URL path, and with the page hosted by the threat actor, these collected URLs could be decoded to gather the email address before they access the PDF. Hightail provides a preview of the PDF before downloading (Figure 3), which shows a faded survey and an icon that appears to lead into the survey.
Figure 2: The Hightail web page hosting a PDF that recipients are encouraged to download
Figure 3: A preview of the PDF hosted on Hightail, encouraging the user to participate in the “mandatory” survey
Once the PDF has been downloaded, a ‘Take Survey’ icon links to one of many credential phishing URLs used in this scheme. As displayed in Figure 4 below, the phishing URLs often change with each different PDF, but continue to remain consistent with the theme of an HR Department survey.
Examples include:
- hxxps://hrsurveyportal[.]work/Start/
- hxxps://my[.]hr-portalsurvey[.]work/
A complete list of identified URLs was used in different PDFs and is included at the end of this document in Table 2. This kind of differentiation allows the threat actors to maintain an appearance of legitimacy in their phishing URLs, while making it more difficult to defend against these attacks by shunning previously used or shared URLs.
Figure 4: PDF with an embedded link to a credential phishing website
This credential phishing campaign, and its variants, have been operating since at least December 5th, 2019. In most of these identified campaigns, the credential phishing pages were the same spoofed “Norton Secured” page, seen in Figure 5, regardless of the URL or the original target company. Older campaigns, primarily seen in December and January, mostly used appspot[.]com sub-domains rather than HR department themed domains and all led to pages like the one shown in Figure 6.
Figure 5: Spoofed login page where credentials are harvested
Figure 6: A less convincing example of a credential phishing page identified in this broader campaign.
When a recipient enters his or her information in any of the credential phishing websites, the data is sent via an HTTP POST to the URL shown in Figure 7. This is most commonly hxxps://nortonsymantecssl[.]000webhostapp[.]com/vlog/. Much like the hrsurvey[.]work URL variants designed to provide an additional sense of legitimacy, this URL also spoofs “Norton Secured”. Recipients are then immediately sent to the SurveyMonkey survey shown in Figure 8.
Figure 7: Credential phishing page source with the highlighted URL where credentials are posted and recipients are redirected.
Figure 8: The final SurveyMonkey survey
The SurveyMonkey survey shown in Figure 8 is of particular importance. First, this survey link is either legitimate and has been repurposed by threat actors, or threat actors themselves went to the effort to create it. Either way, the detail and effort involved in the survey indicates the possible intent of the threat actors to use the survey as a long-term resource across multiple short-lived credential phishing pages. Secondly, this survey leads targeted recipients to a credible conclusion—ending the attack chain in a way that would not leave recipients suspecting that anything suspicious had happened. Many credential phishing campaigns end by redirecting a user to a generic page or displaying a login error message, which can cause users to stop and consider potentially harmful activity that had occurred, leading them to warn others or report the original email. By avoiding such suspicious signposts, the threat actors can further protect their infrastructure and avoid detection.
This campaign presented a convincing impersonation of an HR department delivering a mandatory survey to its employees. The final destination of the chain was a survey hosted on SurveyMonkey—leading recipients to believe that nothing was wrong. The choice of the campaign endpoint—a survey hosted on a well-known legitimate site, rather than an obvious error message or redirect—indicates a level of attention above and beyond what is usually exhibited by credential phishing adversaries. Additionally, custom domains were used to host the credential phishing infrastructure rather than compromised domains, as is often the case with simple credential phishing. Cofense Intelligence assesses that this campaign was carefully designed with long term capability and minimal detection in mind. This has no doubt allowed for the repeated success of this campaign—also quite unusual when it comes to credential phishing.
| Hightail Hosted PDF URLs |
| hxxp://spaces[.]hightail[.]com/receive/gmaTEP8hhh/ |
| hxxp://spaces[.]hightail[.]com/receive/GvXjcQjRac/ |
| hxxp://spaces[.]hightail[.]com/receive/gWGl9E9QrM/ |
| hxxp://spaces[.]hightail[.]com/receive/hiasiM3Bc4/ |
| hxxp://spaces[.]hightail[.]com/receive/Huh5Kd9ngs/ |
| hxxp://spaces[.]hightail[.]com/receive/N2hZnCrDRr/ |
| hxxp://spaces[.]hightail[.]com/receive/NewA1DfvtL/ |
| hxxp://spaces[.]hightail[.]com/receive/pvHwWmHUxB/ |
| hxxp://spaces[.]hightail[.]com/receive/rlTbN1a1sV/ |
| hxxp://spaces[.]hightail[.]com/receive/wgmOI2E6VF/ |
| hxxp://spaces[.]hightail[.]com/receive/yGDAtZ2Cld/ |
| Credential Phishing Pages URLs |
| hxxps://hrsurvey[.]work/Home/ |
| hxxps://hrsurvey[.]work/hr/ |
| hxxps://hrsurveyportal[.]work/begin/ |
| hxxps://hrsurveyportal[.]work/secure/ |
| hxxps://hrsurveyportal[.]work/Start/ |
| hxxps://my[.]hr-portalsurvey[.]work/ |
| hxxps://my[.]hrsurveyportal[.]work/ |
| hxxps://my[.]worksurvey[.]work/ |
| hxxps://secure[.]hrsurveyportal[.]work/ |
| hxxps://mwz1552alry[.]appspot[.]com/ |
| Redirect URLs |
| hxxps://csosun[.]org/administrator/manifests/login[.]php |
| hxxps://nortonsymantecssl[.]000webhostapp[.]com/vlog/ |
| Hosted Survey URL |
| hxxps://www[.]surveymonkey[.]com/r/2MHSTQ8 |
| Downloaded PDF Files | MD5 Hash |
| Employee Satisfaction Survey.pdf | d61822e79a797356598b6296af360f3e |
| Employee Satisfaction Survey.pdf | b760297ada010198d40f585206e2c769 |
| Description | Indicator |
| Cofense Intelligence ATR ID | 36729 |
| Cofense Triage Yara RULE | PM_Intel_CredPhish_36729 |
HOW COFENSE CAN HELP
75% of threats reported to the Cofense Phishing Defense Center are credential phish. Condition users to be resilient to credential harvesting attacks with Cofense PhishMe, plus get visibility of attacks that have bypassed controls with Cofense Reporter.
Easily consume phishing-specific threat intelligence in real time to proactively defend your organization against evolving threats with Cofense Intelligence. Cofense Intelligence customers were already defended against these threats well before the time of this blog posting and received further information in the Active Threat Report 36729.
