Spoofed Training Email from Phishing Simulator Company

By Max Gannon and Brad Haas, Cofense Intelligence

Cofense Intelligence has analyzed a security awareness training-themed campaign that spoofs a training reminder email from KnowBe4. Embedded links in the email direct victims to a credential phishing page targeting both Microsoft Outlook credentials and personal information. The phishing kit is hosted on compromised sites and has been used on at least 30 domains since mid-April 2020, as detailed below.

The emails used in this campaign attempt to pressure recipients into clicking the link by warning that the user only has one day left to complete a required training. They also discourage recipients from browsing directly to legitimate company training pages with the following statement: “Please note this training is not available on the employee training Portal. You need to use the link below to complete the training[.]”

Figure 1: Phishing email spoofing a KnowBe4 notification

The phishing kit used in this attack first collects Outlook credentials, then loads another page soliciting several pieces of personal information.

Figure 2: First page of the credential phishing kit

Figure 3: Second page of the credential phishing kit

As noted, the campaign’s credential phishing kit has been hosted on at least 30 other sites since mid-April 2020. The kits all used the same exfiltration methods and files as the spoofed KnowBe4 campaign, targeting Outlook credentials. Previous campaigns using this kit had a sexual harassment training theme rather than a security training theme. Those campaigns redirected to a legitimate page related to sexual harassment, shown in Figure 4, after the credentials requested in Figure 2 and Figure 3 were entered. The credential phishing kit linked in the spoofed KnowBe4 campaign has already been taken down, but it is very likely that the threat actors redirected from it to a security training-related page instead.

Figure 4: The credential phishing kit from previous campaigns redirected to this page

After additional analysis, we discovered that several of the compromised sites, many of which run WordPress, had recently been used to host a specific web shell, “CHips L MINI SHELL.” The shell has a relatively small feature set, allowing attackers to upload and edit files on a compromised site. It has already been removed from the sites in most instances. However, it was installed on some of them in a way that made it publicly visible, so cached Google search results show that it had been present, as shown in Figure 5.

Figure 5: Web shell on compromised site hosting the credential phishing kit

The indicator of compromise (IOC) table below includes the phishing kit URLs mentioned above.

Table 1: IOCs

Associated Credential Phishing URLs
hxxps://2014[.]digitree[.]co[.]kr/samhwa/lib/bid/login[.]php
hxxps://acertijos[.]com[.]ar/Blog/wp-includes/bid/login[.]php
hxxps://avellanoeuropeo[.]ufro[.]cl/wp-content/plugins/bid/login[.]php
hxxps://breckinridgecounty[.]net/[.]well-known/acme-challenge/bid/login[.]php
hxxps://docentes[.]uto[.]edu[.]bo/dmoyaa/wp-includes/bid/login[.]php
hxxps://g5lab[.]com/aspera/uploads/bid/login[.]php
hxxps://greenup[.]co[.]in/wp-includes/bid/login[.]php
hxxps://kikihalekararlari[.]com/assets/plugins/flot/bid/login[.]php
hxxps://mobiletradesman[.]co[.]uk/wp-admin/bid/login[.]php
hxxps://modoou[.]net/wp-content/bid/login[.]php
hxxps://msk[.]turbolider[.]ru/wp-includes/bid/login[.]php
hxxps://niceoldtownapartment[.]com/wp-content/plugins/fusion-core/tinymce/bid/login[.]php
hxxps://otorrinosensantafe[.]com[.]mx/[.]well-known/pki-validation/bid/login[.]php
hxxps://pandeyize[.]com/[.]well-known/acme-challenge/bid/login[.]php
hxxps://plazaempresarial[.]com/[.]well-known/acme-challenge/bid/login[.]php
hxxps://propertyask[.]com/[.]well-known/pki-validation/bid/login[.]php
hxxps://rashifal[.]com/img/bid/login[.]php
hxxps://rotularltda[.]com/[.]well-known/acme-challenge/bid/login[.]php
hxxps://skinnyontherunapp[.]com/[.]well-known/acme-challenge/bid/login[.]php
hxxps://somelit[.]org/wp-content/plugins/bid/login[.]php
hxxps://tcvsat[.]com/tcvsat-respnov19/wp-includes/IXR/bid/login[.]php
hxxps://thegsmshop[.]com/wp-includes/css/bid/login[.]php
hxxps://www[.]aajtaknews[.]in/wp-content/cache/all/bid/login[.]php
hxxps://www[.]auntynise[.]com/[.]well-known/acme-challenge/bid/login[.]php
hxxps://www[.]happychappybrands[.]com/wp-includes/bid/login[.]php
hxxps://www[.]healthfavour[.]com/wp-includes/css/bid/login[.]php
hxxps://www[.]mvoguesalon[.]com/bootstrap/cache/bid/login[.]php
hxxps://www[.]samicultura[.]com[.]br/includes/bid/login[.]php
hxxps://www[.]search4blog[.]com/wp-content/plugins/bid/login[.]php
hxxps://digitalprakhar[.]com/wp-content/uploads/2016/08/bid/login[.]php

Recommendations

Educating your workforce to identify these threats is key. Organizations can also stay on top of today’s dynamic threat landscape using Cofense Intelligence. Phishing causes nine out of ten data breaches. With Cofense Intelligence, you’ll get access to preemptive phishing alerts you can act on before you’re attacked.

Interested in seeing more? Search our Real Phishing Threats Database.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Message Quarantine Campaign with Overlying Potential

By Dylan Main, Cofense Phishing Defense Center 

Message quarantine phish are back, this time with a new tactic utilizing the targeted company’s homepage as part of the attack. The Cofense Phishing Defense Center (PDC) has identified this campaign which attempts to steal employee credentials by posing as a message quarantine email. Using an overlay tactic to disguise itself, this attack is an example of how threat actors are using more advanced techniques to make these malicious emails appear as though they are from a trusted source. 

Figure 1: Phishing Email

This campaign attempts to imitate the technical support team of the employee’s company and makes it appear as though the company’s email security service has quarantined three messages, blocking them from entering the inbox. It claims these messages failed to process and need to be reviewed in order to confirm validity. It even states that two of these were considered valid and are being held for deletion. This could potentially lead the employee to believe that the messages could be important to the company and entice the employee to review the held emails. Another social engineering technique the threat actor uses to lure the employee into interacting with the email is giving the messages urgency, asking the recipient to review them or they will be deleted after three days. Potential loss of important documents or emails could make the employee more inclined to interact with this email.

Figure 2: Phishing Email 

As seen in Figure 2, hovering over “Review Messages Now” shows the malicious URL. However, upon interacting with the link, the user will be directed to a phishing page unique to the employees’ company. Here is where this campaign uses advanced mechanics to make it appear even more legitimate. 

Figure 3: Cofense Phishing Page 

After interacting with the email, the employee will then be redirected to what appears to be a login screen on the company website (Fig 3). However, further analysis has determined that the page shown is actually the company’s website home page with a fake login panel covering it. This gives the employee a greater comfort level, by displaying to  a familiar page. It is also possible to interact with this page by moving outside of the overlay, showing that it is the actual page they have seen and used before. The overlay itself is attempting to prompt the user to sign in to access the company account. The entered credentials are then sent to the threat actor, giving them access to the target’s company account. 

Figure 4: Microsoft Phishing Page

Based on the analysis performed by the PDC, it was determined that each link, while still going to the same base domain, uses specific parameters to determine which web page pull, then overlays the fake login panel on top. Depending on what company the threat actor is targeting, the link will populate the address of the original recipient of the email. Figures 3 and 4 are examples provided by entering an address, in this case Cofense or Microsoft.  After the equal sign, the link will look at the domain of that address and pull the homepage. This campaign shows that threat actors can and will use any resource available to compromise business accounts.  

HOW COFENSE CAN HELP 

Cofense Resources 

Cofense PhishMeTM offers a simulation template named Email Quarantine Report – Alternate. 

Network IOC IP   
hxxp://google[.]com@ashousingcompany[.]com/www/?email=  104[.]27[.]158[.]208 
hxxp://traximgarage[.]com/www/webmail-std/appsuite/1ogin/mai1/  185[.]68[.]16[.]137 
All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Phishing Threat Preys on Desperate Business Owners

By Kyle Duncan and Noah Mizell, Cofense Phishing Defense Center

For the past few months, businesses across the nation have suffered from the financial strain brought on by COVID-19. Government relief has become a major concern as businesses struggle to stay afloat. The Cofense Phishing Defense Center (PDC) has taken notice of a new phishing campaign that once again aims to abuse Covid-related fear and uncertainty. This campaign imitates the U.S. Small Business Administration (SBA) to harvest the credentials of business owners who may be expecting the administration’s assistance.

While the spoofed address for this attack is one the SBA uses and is even listed on their website, one brief look at this example’s “Received” path shows it did not originate from the SBA.

Figure 1-2: Email Header

These first four stops on the email’s Received path indicate that the email originated from Japanese email servers. This can not only be seen in the Received path but also in other fields of the header information. The Japanese IP address is seen in the Authentication-Results-Original and the Japanese domain can be seen in the Message-ID in some cases.

Figure 3-4: Email Body

The email body of this phish is very clean and well-constructed. Barring the excessive use of commas, the email looks legitimate at a glance. The threat actor has even compiled legitimate logo images and contact information to help sell the deception. Small business owners who have applied for federal aid would be hopeful and relieved to see this message in their inbox.

When you hover over the “Review and Proceed” button, however, the facade falls. Instead of sending users to SBA.gov, this button will redirect to the phishing page:

hXXps://ion-homes[.]com/sba/covid19relief/sba.gov/

The phishing page at this URL redirects to an SBA phishing login page with similar logo, positioning, and details to the real site. While the phishing domain differs, the threat actor has notably attempted to mirror the URL structure from the legitimate SBA’s login URL by tossing in ‘covid19relief’ into the directory name.

Figure 5: Phishing Page

Upon entering their login credentials, users are then redirected to the official SBA website, specifically the login page as seen in Figure 5.

Figure 6: Official Small Business Association Page

Instead of receiving aid, business owners who fall for the scam give away their credentials—adding insult to injury.

LEARN MORE about the Cofense Phishing Defense Center. See how the PDC’s managed phishing response and remediation stops phishing attacks that elude email gateways.

Network IOC  IP  
hXXps://ion-homes[.]com/sba/covid19relief/sba.gov/ 173.231.209.178
All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Twitter Announces Hackers Gained Access via Phishing Attack

By Aaron Higbee

On July 15, 2020 a small number of Twitter employees were duped in a successful spear phishing attack which Twitter is now calling a “phone spear phish”. There is a mention of a phone, but Twitter didn’t elaborate on what role a phone played. (SIM swap? Misleading link via SMS to a credential phishing page?) Regardless, phishing resulted in stolen Twitter employee credentials. Attackers used the stolen credentials to access internal systems and gain information about Twitter processes, then targeted additional employees to breach account support tools. Scam tweets were sent from dozens of major accounts and the hackers quickly received hundreds of bitcoin transfers worth over $115,000. This type of attack is not unusual as 74% of real phish are credential phish.

Human Vulnerabilities

Twitter has now provided limited detail about the specific technique used in the spear phishing attack and has not disclosed how many employees or contractors have access to its account support tools. Broad levels of access can pose challenges to defending against phishing. Twitter shared, “This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems,” and called the incident “a striking reminder of how important each person on our team is in protecting our service”. The attack resulted in:

  • 130 accounts targeted
  • 45 accounts had Tweets sent by attackers
  • 36 accounts had the DM inbox accessed
  • 8 accounts had an archive of “Your Twitter Data” downloaded, none of these are Verified
  • Crypto transfers exceeding $115,000.
  • Untold brand damage to Twitter

Human Informants?

In the blog post, Twitter didn’t mention how many Twitter employees were targeted in the phishing campaigns, how many of those employees reported the phishing attempts, and whether or not Twitter security operations were tooled up to act on employee reports of phishing.

In the Cofense annual report on employee phishing resiliency, you might be surprised to see that Technology companies tend to be on the lower end of industry benchmarks.

Too Much Access?

Twitter admits concern around their tools and levels of employee access, yet goes on to claim that access to proprietary tools is “strictly limited and only granted for valid business reasons”. Twitter advises that they have now “significantly limited access to our internal tools and systems” while they complete their investigation, citing “we have teams around the world” that help with account support. Users with account support needs, reported Tweets and applications to Twitter’s developer platform can expect delays. Twitter is focused on restoring access for all account owners who may still be locked out.

Portrait of a Phish

Whether the hackers gained access via phone, a personal device, or office computer, the aim of the attack was to obtain employee credentials. Twitter advises that although their tools, controls, and processes are constantly being updated and improved, they are now “taking a hard look” at how they can make them even more sophisticated.

The specifics of the phish that evaded security controls are vague. Spear phishing tends to be more targeted and dangerous than a typical phishing attack, because the phishing emails are highly believable when tailored to individuals or small, specific groups of people. “Phone phishing” is messy infosec jargon that tends to be a catch-all for all things social engineering that involve a mobile device. A phish via phone could appear to be many things: a message from support requesting credentials for an update, an SMS phish linking the user to a false company login page, or an actual phone call from a friendly colleague requesting login information.

If employees are unaware of the role they play in data breaches, they are more likely to fall for these scams. No amount of security controls can fully secure a network unless employees are also seen as the frontline in phishing defense. Twitter needs to consider building employee resilience to phishing in their plan to become more sophisticated.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Adding a Human Layer of Defense to Email Security

Guest Author: Edward Amoroso, Chief Executive Officer & Analyst, TAG Cyber

For over a decade, a quantitative index hosted at NYU’s Center for Cyber Security (CCS) has been used to measure the sentiment of expert practitioners across a range of cyber threat and enterprise security issues. While the index value has increased continually over the years, which indicates growing concern among the participating experts that threats are increasing, significant spikes in any measured attribute have rarely occurred – until recently.

Since early 2020, the NYU research team has measured increased concerns regarding email security risk, and, in particular, with phishing messages reaching user in-boxes. This result might seem somewhat expected, given the increased number of people working from home during the COVID-19 pandemic. But enterprise teams routinely include world-class commercial security solutions such as secure email gateways (SEGs), so this seemed inconsistent with the sentiment spike.

Working with the phishing defense experts from Leesburg-based Cofense, Dr. Edward Amoroso, head of research advisory company TAG Cyber, which helps to administer the NYU CCS index, sought to investigate what was going on. A brief survey was constructed and shared with a dozen experts operating secure email infrastructure. Each was asked whether, and how frequently, phishing attacks were finding their way past their existing email defenses, all of which included a SEG.

The results were interesting: fully half reported that potentially dangerous phishing messages reached employee in-boxes roughly once per week, and the other half reported not having sufficiently accurate data to even answer the question. Frankly, both of these answers seemed disturbing – even though they helped to explain the spike in the NYU index. Clearly, something troublesome has been going on recently with email security.

Aaron Higbee, Cofense CTO and Co-Founder, and Tonia Dudley, Cofense Security Solutions Advisor, shared their own approach to this growing problem during a recent webinar jointly hosted by TAG Cyber. In short, the Cofense solution introduces a human layer of protection to complement existing defenses to create a more defense-in-depth model for addressing phishing risk. The human aspect is enhanced in the Cofense approach using crowdsourced support, which results in complementary intelligence about email threats. It seems a sensible addition.

What you’ll find from the discussion during this recent webcast is that while traditional firewalls and other security gateway devices are important parts of a layered defense, they are obviously nowhere near sufficient to protect an enterprise. The Cofense team believes, and makes the strong case, that SEGs also benefit from the introduction of additional complementary protections – which involve the human-oriented controls mentioned above.

If you’re like the experts who respond to the NYU CCS index, then you are feeling increased stress about phishing risks to your enterprise. This suggests that adding some sensible security controls into a multilayered protection solution would be advised.

Learn more about how Cofense helps organizations by combining the power of human detection with automated response, enabling your teams to stop phishing attacks in minutes.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Threat Actors Bypass Gateways with Google Ad Redirects

By Dylan Main and Harsh Patel, Cofense Phishing Defense Center

The Cofense Phishing Defense Center (PDC) has observed a phishing campaign that attempts to steal Office 365 login credentials by luring employees to accept a new Terms of Use and Privacy Policy. This new campaign has been seen across multiple organizations and uses advanced techniques to garner employee login credentials, including a Google Ad Services redirect to fool email gateways.

Figure 1: Headers

The originating IP in the headers of this email proved its source was coming from a legitimate account with the ‘from’ address “info@jtpsecurity[.]co[.]za” It appeared as though this email address was compromised and then used to send the phish to multiple employees. The word “security” in the from address could potentially lull the user into trusting the email’s origin.

Figure 2: Email Preview

At first glance, the user will see “This message was sent with High Importance.” Again, the from address contains the word security and the subject talks about a “Recent Policy Change,” creating urgency to click and handle the matter immediately.

The email body talks about accepting the newly updated “Terms of Use & Privacy Policy.” Also, it notes how this new policy will affect personal data and discontinue all active services on the user’s account. Curious users will likely want to “Learn More.”

Figure 3 shows the URL embedded in both buttons, “Accept” and “Learn More”:

Figure 3: URL redirect of the buttons

As seen in the above figure, the threat actor has utilized a Google Ad Services redirect to pilot users to their phish. This suggests that the threat actor(s) may have paid to have the URL go through an authorized source. In turn, this easily bypasses secure email gateways and exposes employees to the phish.

Upon clicking on either button, users are redirected to a duplicate of the real Microsoft page at the URL:

hXXps://microsoftoffice-servicepolicy-onlineserver[.]comisys[.]host/common/oauth2-authorize

 On this page users are presented with a pop up of the privacy policy the email mentions. In this window there are two notable logos as well, a Microsoft logo and the user’s company’s logo, in a bid to make this page appear that much more legitimate. Scrolling through the text box you can see the Privacy Statement was taken from Microsoft’s website.

Figure 4: First Page of the phishing attack

After accepting the updated policy, the user is then redirected to a Microsoft login page, which impersonates the Office 365 login page. An employee who enters their credentials and clicks “Next” will have sent the Threat Actor(s) their Microsoft credentials and compromised their account.

Figure 5: Second Page (The actual phishing)

Following the login page, users find further reason to believe the update is legitimate, one more box saying, “We’ve updated our terms.” Upon clicking the “Finish” button, they’ll be all set.

Figure 6: Third Page (Post entering credentials)

Last step: users are redirected to the legitimate Microsoft page, their Service Agreement, to complete the scam. Nothing malicious here!

Figure 7: Final Page (Official Microsoft site)

LEARN MORE about the Cofense Phishing Defense Center. See how the PDC’s managed phishing response and remediation stops the phishing attacks that elude email gateways.

Indicators of Compromise:

Network IOCs IP  
hxxps://www[.]googleadservices[.]com/pagead/aclk?sa=L&ai=C3seiJpC5XstooZGJBrPArsADp__a3lyH_4PTjAqoqKfonA8QASC7-_keYISV7IXcHaABzavQ-gPIAQmpAt6UwcHeNU0-qAMByANKqgTEAU_Q2dNvWCQ_LtumFUNLEz16PFVhg8cC3HmYEdlxma4KWUfGkvbdLFpKvCC92odSoiBTw9idw1iHRgreOTD1xyzoBBif4axm3JFTnekl_2_OeuLDQv0U_HzVVt10Iu5SkzsX6nGWyfUgPHIgJkxJqY4me8SG8d0nlmJ8PumQhJhze02bPmqEr4puzh2awPAoHoVPQ7QaXlbeJvf4W7Wexg1RGQ0EqMY8Z7YLfyh6tceagXiYGwWU1r3H9HuiISfj4G-RYYTABM-Sru2hAsAFBfoFBgglEAEYAJAGAaAGLoAHm9SvBYgHAZAHAqgHjs4bqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RuoB_PRG6gH7NUbqAeW2BuoB8LaG9gHAMAIAdIIBggAEAIYGoAKAZALA5gLAcgLAYAMAeAS_6jY_crtxomjAdgTDg&ae=1&num=1&cid=CAMSeQClSFh3L5xTIDfFt35D8xjVEHFCYXr5NOlTRany4t_BBsFsAp3b7XCD0nSBKDirzhPVamy0H75uzx6gQxh5_rKDAlBAJWTUCf1Tqi6saFbojDtHd_R8dtCePj4ZvH0zHZWyRITLXvztggY2ibrWY9oLm5X8Wcuetvk&sig=AOD64_0L9hd4oCjDoroDTf6-7Fkon2bwsw&ctype=5&client=ca-pub-1169945711933407&adurl=https%3A%2F%2Fmicrosoftoffice-servicepolicy-onlineserver[.]comisys[.]host172[.]217[.]7[.]226
hxxps://microsoftoffice-servicepolicy-onlineserver[.]comisys[.]host/198[.]23[.]137[.]146
All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

FedRAMP Authorization: Why ‘Moderate’ Matters

By Rose Ryan, Cofense Product Marketing Manager

FedRAMP, the federal program created to assess the security of cloud service providers (CSPs), saves time and cuts costs for U.S. government agencies that would otherwise conduct their own assessments. CSPs are granted authorizations at three impact levels: low (includes low-baseline and low-impact SaaS “li-SaaS”), moderate, and high, aligned to the impact levels based on NIST guidelines. While the high-impact level protects the most sensitive government data, the moderate-impact level meets the needs of many agencies. And the gaping chasm in requirements between moderate and low is revealing.

Why Cofense Didn’t Take the Low Road

Why make the financial commitment, endure a rigorous authorization process and establish a continuous monitoring program when we could have simply self-attested our security controls for a li-SaaS classification? Because Cofense is a security company that prioritizes providing the highest level of protection to our customers, and a low-level certification just wasn’t good enough. That is why Cofense PhishMe is in the process of achieving FedRAMP moderate status.

Moderate vs. Low Impact Levels

Got PII? Cofense Has You Covered

Cofense recognizes that our products and services handle our customers’ personally identifiable information (PII). That’s why we went all in to certify at the FedRAMP moderate level, complying with 325 stringent controls to secure our customers’ data according to confidentiality, availability, and integrity. A moderate FedRAMP authorized CSP has a far more stringent set of controls as compared to CSP with a low or li-SaaS ranking. See a list of controls here.

The impact level of a moderate service offering is based on the sensitivity of the data that an information system processes, stores, and transmits. Cofense opted for moderate FedRAMP compliance for our PhishMe solution. This required the establishment and documentation of a highly secure environment that will withstand comprehensive, rigorous review before we may engage with Federal agencies as a FedRAMP CSP.

Controls: The Numbers Say It All

Additional security controls are added as the levels progress to ensure that government data is adequately protected. High-level systems have 421 baseline controls, moderate-level systems have 325 controls, while low-level systems have only 125 controls and li-SaaS require a minimal 36 controls. Cofense opted for the moderate level, which will allow us to support a mass of government agencies.

Additional security controls are added as the levels progress to ensure that government data is adequately protected.

Continuous Assurance with Cofense

With a moderate FedRAMP authorized solution, there is a strict security implementation as well as operational requirements that PII data be protected. With a li-SaaS implementation, there is no such assurance. And it doesn’t end there. FedRAMP requires that authorized CSPs engage in continuous monitoring after authorization is achieved. The authorization can be revoked if the CSP is found to be at any point in non-compliance with FedRAMP requirements. Cofense opted for a moderate FedRAMP authorization embracing these strict requirements and ongoing monitoring to meet our customer’s security needs and assure their peace of mind. Cofense PhishMe just completed the security assessment review with the sponsoring agency and FedRAMP PMO and we are now in the final stages of the authorization process.

Learn moresee how Cofense is participating in the FedRAMP program.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Invoice Themed Phishing Emails Are Spreading from Trusted Links

By: Kian Mahdavi, Cofense Phishing Defense Center

The Cofense Phishing Defense Center (PDC) is seeing continued growth in phishing attacks which harvests users’ credentials via genuine file-sharing websites, which are found in environments protected by Proofpoint’s Secure Email Gateway (SEG). A huge factor in this campaign is the confidence users have in emails containing the “trusted” Dropbox reference.

It is tricky for SEGs to keep up with attempts to spread phishing attacks and malware via sharing services such as Dropbox, ShareFile, WeTransfer, Google Docs, Egnyte and even SharePoint. Fortunately, a few of our clients’ users reported the phishing emails via the Cofense Reporter button.

The “traditional” methodology for attackers was to “break in.” Nowadays, they easily can “login,” thanks to sharing sites.

Figure 1 – Body of email showcasing the victory of this attack tying in with user interaction

The spear phishing attack sends a link requesting users to access a purchase order form with a (.pdf) extension. Upon clicking, the attack automatically redirects the user to their default web browser, requesting to click the “Download” button. The website will begin the download inside the “Downloads” folder. Nothing sinister going on, right?

The ‘sent addresses’ TLD – “actionsportsequipment[.]com” – coincidentally relates to the nature of the client’s industry; this demonstrates the extent the attackers went to, in a bid to slip through the “secure” environment. One must question themself: “Was I expecting this transfer?” and “Am I expecting to receive a purchase order from this sender?”

Moreover, since the emails have been authenticated against Dropbox’s internal servers, the emails pass basic email security checks such as DKIM and SPF.

Figure 2 & 3 – Downloadable purchase order file

Once the download has been completed, the user is prompted to open the (.html) link assuming the “purchase order” form would appear, however upon clicking, the campaign redirects the user to a supposed “Microsoft” login page.

In this case, the attackers used the free website builder “Weebly.com” … yet another legitimate source, further deceiving the security measures in place with trusted redirect domains and IPs which will naturally continue to be white-listed and deemed “safe” since millions of users share data with one another on a daily basis.

For this reason, the presence of the padlock appears, adding not only security on both parties, but also the illusion that the website is “secure.”

Figure 5 – Phishing site built by Weebly

Once credentials have been supplied, the campaign redirects the user to the authentic ‘office[.]com’ webpage, which could even be enough to assure users it was a genuine procedure. A user’s personal data could potentially be in the hands of the threat actor, assuming they logged in with their true Microsoft credentials.

Figure 6 – Redirect to Microsoft Office webpage  

Indicators of Compromise:

Network IOC IP
hXXps://www[.]dropbox[.]com/l/AADOPQGXtuDK03QYuvJqI0MbDlDxBTV28Cs
hXXps://www[.]dropbox[.]com/l/AAAtWq-LVZcqXBnFLinUi9rB3LpEijuPo78
162[.]125[.]6[.]1
hXXps://helpsupport0ffice20[.]weebly[.]com/ 199[.]34[.]228[.]53
199[.]34[.]228[.]54

LEARN MORE about the Cofense Phishing Defense Center. See how the PDC’s managed phishing response and remediation stops the phishing attacks that elude email gateways.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Practitioners Report the Need for Layered Email Security

By: Edward Amoroso, CEO and Analyst, TAG Cyber

In a recent survey, a majority of practitioners agreed on the need for protection that augments email gateways to deal with phishing attacks.

As phishing has become more prevalent and sophisticated, security experts have focused more on securing endpoints and email, the latter being the simplest way into an organization’s network. While cyber security teams have numerous defensive controls, according to a recent industry survey conducted jointly by TAG Cyber and Cofense, experts agree that deployed controls such as secure email gateways (SEGs) are necessary as a first line of defense but, on their own, aren’t sufficient to keep attackers from exploiting the endpoint.

On July 22, 2020, TAG Cyber and Cofense will present a webinar to discuss the survey results and present phishing defense strategies for companies who want to increase their efficacy against phishing attacks. You can learn more about the webinar and register here.

The survey asked security practitioners to answer the following question: Our security team sees phishing emails get past our Secure Email Gateway (SEG) at the following rate:

  1. Never
  2. Daily
  3. Weekly
  4. Monthly
  5. Hourly

Conducted by email and web and targeted at mid-to-senior level security practitioners, the survey concluded that 50% of organizations report that phishing emails bypass deployed SEGs daily. One respondent, the Chief Information Security Officer of a major financial institution, replied, “SEGs are getting much better at blocking emails with links and forms, but spam asking for money or hardware or simply probing for valid email addresses still get through at a daily rate.”

Another respondent, also a CISO at a financial firm responded, “Phishing emails will always get through. I don’t think any SEG is going to be 100% effective, or even 75%, because there are so many variables that can be changed to evade detection. We accept this to be true, and therefore have other controls…that can block access to the links once clicked, isolation that can render pages inert, or visual cues to indicate to the employees that the e-mail might not be safe.”

The remaining 50% of respondents reported that phishing emails bypass SEGs weekly (26%) and monthly (24%). Frank Abelson, President of Navitend, which provides managed services, including security to business and government customers, agreed that a layered approach is recommended. “Many of our clients combine gateway solutions with additional controls such as training to protect their inboxes from phishing,” he said.

Aaron Higbee, CTO of Cofense, sees this as an opportunity. “We have known for years that human detection combined with automation is necessary to protect employees from phishing attacks,” he said. “We are not surprised that this TAG Cyber survey found attacks leaking into enterprise inboxes.”

To learn more about the survey’s results and layered phishing defenses, register for the webinar.

 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

HMRC latest target in global COVID relief phishing campaigns

By Jake Longden, Cofense Phishing Defense Center

Taxes and rebates have long been some of a phisher’s favorite targets. Now the coronavirus has provided a fresh new way to exploit this topic: the government grants designed to help small businesses and those out of work due to the pandemic.

The Cofense Phishing Defense Center (PDC) has observed a new phishing campaign in the U.K. that aims to harvest HMRC (Her Majesties Revenue and Customs) credentials and sensitive personal information by preying on employees who are expecting COVID relief grants.

With multiple world governments providing such grants, this is an easily modifiable tactic—simply modify the email to spoof the target country’s tax service.

Figure 1: Email Header

To add authenticity to the email, the threat actors have used an email address (hmrc@hotmail.com) with the impersonated organization in the name and set the name to match (HM Revenue & Customs). That, combined with the subject line, is a great way to attract the user’s interest (“Helping you during this covid from government”). Whilst this sentence is not using the greatest grammar, who wouldn’t want government assistance during these difficult times?

Figure 2: Email Body

When first viewing the email, the user is presented with a notification that the government is offering between £2500 and £7500 in tax grants for those whose work has been affected by the virus. The email includes a link to check their eligibility. With the government publicly and repeatedly mentioning such sums,  the email is believable to inattentive users. The attacker also mentions the “Open Government License v3.0,” a legitimate copyright license used by the Government and Crown Services, to provide additional credibility.

Figure 3: Phishing Page

Once the link is clicked, the user is presented with a realistic clone of the GOV.UK website. This may alleviate concerns a user may have and provide a false sense of security, as the page is extremely similar to the HMRC account sign-in page. The biggest red flag: the URL, just-bee.nl, is not relevant.

Figure 4: Phishing Page

Figure 5: Phishing Page

Here the user is asked to enter some very personal and sensitive data. Another sign that this is a scam: the volume and sensitivity of data requested far exceeds what is required to sign into a legitimate account. The data requested here screams “identity theft/impersonation.”

From there, the user is directed to a page that seems to be loading, to help provide the impression that the data is being processed and an eligibility check performed.

Figure 6: Processing Page

 

Network IOC IP
hXXps://www[.]lagesports[.]com/[.]tmb/xml[.]php 69[.]10[.]32[.]186
hXXps://rtoutletpremium[.]com[.]br/[.]well-known/pki-validation/UTR/index[.]php 162[.]241[.]182[.]5

 

How Cofense Can Help

Visit Cofense’s Coronavirus Phishing Infocenter to stay up to date as threats evolve. Our site is updated with screenshots and YARA rules as we continue to track campaigns.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.