Cofense Increases Efficiency and Visibility with Triage 1.25

With Triage 1.25, SOC teams can now supercharge their efficiency through automation, enhanced reporting, and revamped response templates to more quickly to fight back against today’s evolving threats. Here’s the breakdown of what that looks like in action.

Automate More Easily with Triggers

Playbooks, introduced in Triage 1.24.0, let you perform a reusable set of actions on a reported email or cluster of emails with a single button click. Now, automate your playbooks with triggers. When a report meets the conditions you specify in the trigger, the trigger runs your desired playbook automatically! This means less clicks and manual effort when it comes to triaging malicious emails and sending automated communications to your end users. It also means that deep YARA rule writing skills are not needed to write triggers, making it easy for any SOC team member to get into and begin using Triage quickly.

To create a trigger, you simply select one or more of the following conditions and then build the trigger around it. Analysts leverage a combination of conditions that make sense based on the type of attack, threat vector, what’s common to their industry, or more.

  • Report Content
  • Reporter Reputation
  • Reporter VIP Status
  • Risk Score
  • Rule Match
  • Rule Priority
  • Rule Count
  • Threat Indicator Value
  • Threat Indicator Count


Active Triggers Dashboard
Triggers and Playbooks allow you more flexibility and granularity when it comes to automating actions across Triage and teams. As a result, our recipes function will be sunset as Playbooks offer much deeper functionality. Not to worry though, we’ll give plenty of notice and even added a button so you can begin to convert your Recipes to Playbooks.

Enhanced Reporting

We released Dynamic Reporting in the Summer of 2021 and continue to build on our strong reporting foundation with more flexibility when it comes to building and distributing reports. The templates that generate dynamic reports are now more robust, with new sections and more options to help you format and refine the data in your output. We’ve also added PDF support so you can distribute reports to any user in an easy to consume format.


Add or Remove Sections and build a bespoke Report

Best practice categories and response templates

The default set now contains six malicious categories and five non-malicious ones. These new defaults reduce the need for customization and better reflect current phishing trends we are seeing in the field. These fields help prevent confusion and allow SOCs to more quickly understand what threats they are seeing.

And due to popular demand, we are bringing back a workflow called “Categorize Reports.” You can still use the new, quicker way to start workflows, but we wanted to bring more options for our users.

To learn more about Cofense Triage or to see these new capabilities in action, please request a demo at https://go.cofense.com/live-demo/. Cofense Customers can always reach out to their CX team for more information on upgrading.

*Please note: Customers must be Triage versions 1.24.0 or 1.24.1 in order to upgrade to 1.25.0*

Ransomware Themed Phishing Attack

Countdown Timer: Ransomware Themed Phishing Attack

By Adam Martin, Cofense Phishing Defense Center

The Phishing Defense Center (PDC) observes a large variety of phishing techniques and lures throughout our customer base. Some of those techniques are quite unique methods of getting the end user to interact with the message. As illustrated below in Figure 1, the recipient is advised about a suspicious login, alluding to login location issues, and is offered a solution in the form of email verification. The name of the proposed security software company “DNS Domain Name Server” is vague enough but “tech” sounding enough to convince the unsuspecting recipient that this could indeed be their native security service.

Figure 1 Initial Email

What sets this phish apart from other campaigns is the graphic displayed to the recipient once the malicious link is accessed. For the purposes of this example, fake information has been provided to the hosting server.

Figure 2 Example Email Address

Once accessed, the page shown in Figure 3 is displayed. The page runs in a loop with randomly generated names assigned to the domain based off the target company’s domain. Sharing some similarities with ransomware, the target company is faced with a countdown timer and the choice of stopping the deletion of potentially companywide email access or entering their credentials. The timer also shares ransomware type panic creation all designed to push the recipient into entering their credentials without second guessing. These details aren’t deleted and a merely randomly generated as part of the scare tactic. Much the same as a ransomware “timer” for permanent file deletion should the ransom not be paid.

Figure 3 Ransomware style note displayed

As is the normal case with phishing incidents, once credentials have been provided by the recipient, one of two actions generally take place. The password “input” box will return “wrong password” with the details posted to the C2 address. Alternatively, you’ll be redirected to a new page along the lines of “validating” the account, which will eventually revert to the homepage of the target organization, as seen in Figure 4. In this case, after several different variations of “validating, checking, confirming” the user was ultimately redirected back to their own company’s home page.

Ransomware Themed Phishing Attack

Figure 4 Validation loop

Indicators of Compromise IP
hXXp[:]//nameserversecurity[.]com/[account]_[verification.php]?cust_mail 199[.]188[.]205[.]252

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats. Past performance is not indicative of future results. 

The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.  

How Crowdsourced Intelligence Stops Attacks that Bypass Technology

By Dave Alison, VP Product, Cofense

Cofense has focused on the human side of email security for over a decade. This focus requires that we look at the threat landscape through a unique lens – not just the conditioning of employees to spot suspicious emails, but to leverage our intelligence to eliminate threats other employees in other organizations around the world have just reported.

What does that mean? At a high level, it means that crowdsourced human intelligence is stopping attacks BEFORE it happens.

Every day, thousands of novel attacks are launched via email against organizations large and small. These bypass perimeter security technology and land in unsuspecting employee inboxes, potentially causing millions of dollars in damages as threat actors trick unsuspecting employees into activating these payloads or handing over their credentials.

How It Works

Cofense has millions of trained human sensors deployed across organizations and sectors around the world actively reporting those attacks to us as these campaigns hit their inboxes. These emails, combined with other proprietary collections, are analyzed by our Cofense Intelligence team, which examines these threats in close to real time, and quickly provides intelligence derived from these verified attacks to our customers.

This intelligence subsequently feeds an Auto-Quarantine capability, which removes malicious emails from an inbox in minutes, often before users see or have a chance to open the email.

As this rich intelligence is disseminated via our Intelligence API feed, these Indicators of Compromise (IOCs) are deployed to any instance where our customers have Auto-Quarantine fully enabled. Here’s how this unfolds:

  1. A new attack that evades the secure email gateway (SEG) reaches one or multiple employee inboxes. 
  2. An employee receives the malicious email and believes it is suspicious. They use the Cofense Reporter to notify their security team or our Cofense Phishing Defense Center (PDC). 
  3. A Cofense Intelligence Analyst performs a review of malicious reported emails, building out an Active Threat Report (ATR) and extracting the Indicators of Compromise (IOC). There are over 50K of these IOCs generated every month. 
  4. The IOCs are then sent to the Cofense Vision customers, with a 5-minute check-in schedule for any new ATRs added or updated 
  5. Vision AutoQuarantine examines incoming and existing email for the new IOCs and, if found, automatically moves the emails into quarantine. 

What We’ve Found

The results are shown in the following graph, which charts the number of emails our system identified as malicious after these got through the SEGs, or other various email controls, that protect it.

As you can see, this complete loop is having a powerful impact on the threat landscape. Cofense has operationalized the human security layer, addressing the threats that inevitably make it through the technology layer.

It’s important to note that while each SEG available on the market has varying degrees of effectiveness in identifying these threats, we observe thousands of attacks that have evaded every SEG available. This includes large, well configured customer environments protected by Microsoft, Proofpoint, Cisco IronPort, Mimecast, etc. The actual attack types we see also run a broad range: malware leading to ransomware, credential phish, business email compromise, targeted attacks against VIPs, etc.

Cofense continues to make great strides in increasing the speed of that loop, getting the IOCs into the email stream quickly. Now, more than ever, Vision with Auto-Quarantine provides the best defense against the attacks that are continuing to make an impact.

Cofense Quarterly Phishing Intelligence Review: 3 Key Takeaways

The Cofense Intelligence team released its Quarterly Phishing Intelligence Review for the second quarter of 2022, which highlights significant shifts in the phishing threat landscape, with some key takeaways highlighted below.

Top five malware types in Q2 2022 and Q1 2022, by volume of emails.

  1. Emotet campaigns continued to sustain, however their overall volume dropped significantly compared to the first quarter of 2022, leading to an overall reduction in phishing activity. However, don’t get too comfortable. Four of the top five malware families most frequently delivered via phishing (FormGrabber, Agent Tesla, QakBot, and Remcos RAT) all saw increases in volume.
  2. Changes in QakBot delivery tactics made QakBot a far more potent threat. Phishing campaigns delivering QakBot became the most effective in terms of reaching end users. QakBot campaigns now go to extensive lengths to bypass security measures, avoid detection, and obstruct analysis tactics. Read the report for more details regarding these effective tactics.
  3. Business Email Compromise (BEC) campaigns continue to impart more financial loss on companies than any other cyber threat. Our team dove into what it looks like when a target interacts with a BEC actor as part of our latest strategic analysis.

BEC Campaigns Like The One Above Reach End Users Regularly

Tired of reading? Well, great news! You can watch our Quarterly Threat Briefing for Q2, which covers many of the report’s findings, on demand here.

GuLoader Rises as a Top Malware Delivery Mechanism in Phishing

By Brad Haas, Cofense Intelligence

There’s a new malware delivery mechanism in town, and it’s competing in volume with the most tried-and-true delivery methods like malicious Microsoft Office macros.

GuLoader, a small but dangerously sophisticated loader, emerged early this year and rapidly became one of the most popular delivery mechanisms, used by numerous threat actors to deliver a wide assortment of malware. Its popularity can be explained by its simplicity and sophistication—it is both easy to use and extremely effective, designed to evade multiple security measures and then download and execute malware while going undetected. A recent report indicates that it is sold openly, making it easier for threat actors to obtain. As long as GuLoader is profitable, its authors will have an incentive to continue to improve it, making it a potential long-term threat.

GuLoader’s Meteoric Rise

GuLoader was first seen in the wild near the beginning of 2020. As discussed in the Cofense Q2 2020 Phishing Review, it surged in popularity during the second quarter particularly in the month of May. Several other delivery mechanisms dropped off almost entirely as GuLoader increased. It became nearly as common as each of the Microsoft Office document delivery mechanisms: CVE-2017-11882 and Office Macros, which have been dominant for months. GuLoader is most commonly used to deliver remote administration tools, but has also been observed delivering keyloggers, credential stealers, and other malware phenotypes.

Figure 1: During May 2020, GuLoader was briefly the most popular delivery mechanism.

Why GuLoader?

The most successful delivery mechanisms go undetected as they arrive in a victim’s inbox. This is likely why Office documents remain so popular; they are less obviously malicious than executable binary or script files. GuLoader is an executable file, but it uses sophisticated techniques (discussed below) to go unnoticed during delivery and during its execution. GuLoader has also been changed and updated with new features over time, making it increasingly useful as a delivery mechanism.

Advanced Evasion Features

GuLoader uses advanced techniques at every stage of execution to try to evade network, email, and host-based security technology:

  • Email attachment scanning: Obfuscation and encryption hide GuLoader’s actual functions. Without executing at least a portion of it, an antivirus product cannot detect what it does.
  • Dynamic or sandbox analysis: GuLoader contains false code instructions designed to thwart analysis tools and a wide array of tricks to avoid executing in virtual or sandbox environments.
  • Domain and network controls: Threat actors using GuLoader store their malicious payloads on cloud platforms like Google Drive and Microsoft OneDrive. These platforms are often treated as trusted assets in every organization and thus are not frequently subjected to comprehensive analysis or blocking.
  • Network-based scanning: Each malicious payload is encrypted with a key unique to its campaign, so neither the cloud services nor a network traffic analyzer is able to tell what it is.
  • Endpoint security products: GuLoader can start up legitimate Windows programs and inject itself into their memory space, giving the malicious payload cover from endpoint analysis.

Figure 2: Shipping-themed phish with GuLoader in an ISO attachment

Cofense Intelligence customers can find more details and associated indicators of compromise in our 23 July 2020 Strategic Analysis. Not a customer? Learn how our phishing alerts help mitigate today’s dynamic threats.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

New Mass Logger Malware Could Be Massive

By Max Gannon

Cofense Intelligence is tracking a recently released keylogger named “Mass Logger” which could significantly impact the keylogger market and the phishing threat landscape.

Speedy Development Could Spur Adoption

Today, keyloggers make up the largest volume of unique phishing campaigns by malware type, and they continue to grow in popularity and sophistication. One of the key concerns with Mass Logger is its updating speed. The author of Mass Logger consistently updates and improves the malware, which allows its operators to respond quickly to overcome security measures taken to detect and defend against it. Speedy development also allows the malware’s creator to quickly add features in response to customer feedback, which may lead to an increase in this malware’s popularity.

For example, Cofense Intelligence has identified a campaign that used an attached GuLoader executable to deliver an encrypted Mass Logger binary. GuLoader has recently risen to prominence as a malware delivery mechanism which downloads encrypted payloads hosted on legitimate file sharing platforms. The email used to exfiltrate data in this campaign was also recently seen in an Agent Tesla keylogger campaign, indicating that some threat actors may already be switching from Agent Tesla to Mass Logger.

Advanced Functionality, With More Likely to Come

The creator of Mass Logger, known as NYANxCAT, is responsible for several other well-known and prolific malware types, including LimeRAT, AsyncRAT, and other RAT variants. NYANxCAT’s malware tends to be feature rich and easy to use, allowing for easy adoption by amateur threat actors. Despite this relatively low entry bar, many of the features incorporated into Mass Logger are advanced, such as its USB spreading capability.

The capable actor behind these malware families has demonstrated an investment in Mass Logger, improving the functionality of the malware with 13 updates in only a three-week time period. In patch notes, NYANxCAT references the addition of new targets for its credential stealing functionality and includes measures taken that would reduce automated detection. Based on these feature additions and improvements, it is likely that NYANxCAT will continue to invest in and update this keylogger.

Sophisticated features distinguish Mass Logger from other common malware. For example, it includes a function that enables a cyber-criminal to search for files with a specific file extension and exfiltrate them. In order to defend against Mass Logger and similar threats, network defenders should watch for FTP sessions or emails sent from the local network that do not conform to your organization’s standards. Also, tune sandbox systems to look for anti-analysis and evasion techniques and disable password-saving in applications like Firefox.

Get 3 FREE Months of Cofense Intelligence

Like what you read in this blog? Cofense Intelligence customers received the IOCs associated with Mass Logger as well as a technical analytic writeup of the new keylogger. If you are not a current Cofense Intelligence customer, this is the time to take advantage of our free 90 day access offer, allowing you to receive even more detailed insights into phishing and malware threats that evade email gateways—yours free for 3 months.

 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Available Today: The Cofense Intelligence Q1 2020 Phishing Review

By Mollie MacDougall, Cofense Intelligence

Today, Cofense Intelligence released its Q1 2020 Phishing Review. This report highlights key phishing trends uncovered by Cofense Intelligence analysts, who spend every day analyzing current phishing campaigns and producing actionable phishing intelligence. This intelligence keeps our customers proactively defended against emerging phishing tactics, techniques and procedures (TTPs). Our analysts focus on campaigns that reach enterprise user inboxes, and report on the TTPs designed to evade secure email gateways (SEGs) and other network defense technology.

Report Highlights

The first quarter of 2020 began with a continued seasonal lull in malware volume and ended with a drastic spike in the quarter’s last six weeks, as the COVID-19 virus evolved from emerging crisis to global pandemic. While Emotet volume overall was lower than expected, phishing campaigns leveraging COVID-19 and remote work themes surged in March 2020.

Figure 1: Credential phishing campaign that leveraged COVID-19

While the widespread use of ransomware has not returned to its peak, Cofense Intelligence analyzed targeted ransomware campaigns using themes that leveraged the global pandemic. Ransomware operators have also upped the ante on several campaigns, combining ransomware infection with a data breach and releasing sensitive data if ransom is not paid. This strategy has garnered a great deal of attention in recent headlines, as it further extorts organizations who are prepared to recover from ransomware campaigns and otherwise would not pay off their attackers.

Several campaigns discovered by Cofense Intelligence last quarter used trusted sources to evade perimeter defenses. Organizations rely on trusted platforms and services to conduct efficient business operations, and threat actors are eager to abuse these trusted services to compromise users. Cofense Intelligence has analyzed multiple campaigns that have used trusted sources as a part of the infection chain. These sources include, but are not limited to, cloud services, customer/employee engagement surveys, and third-party connections.

Read our Q1 2020 Phishing Review for more detailed trends identified by Cofense Intelligence and to see our phishing predictions for the  months ahead. Spoiler alert: phishing campaigns are likely to increasingly focus on the upcoming United States general election as well as the global pandemic and the work and lifestyle shifts it has precipitated. We also assess that ransomware campaigns will very likely continue to increase. Finally, we predict that Emotet will again resume phishing campaigns in Q2.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Coronavirus-Themed Phish Continue to Surge

By Max Gannon

Since our reporting on Coronavirus-themed phishing campaigns began, Cofense Intelligence has seen them surge, along with associated malware families. As more enterprises and government entities mandate remote work, threat actors stand to gain from using “work from home” or “Coronavirus” themed phishing emails. We recently explored this in a Flash Alert and Strategic Analysis that Cofense Intelligence customers received, highlighting the impersonation of trusted brands like Google Drive in complex campaigns and offering mitigation steps.

Primary Observed Trends

Over the past month, Cofense Intelligence has identified the following trends prevalent in COVID-19 themed phishing campaigns. Credential phishing campaigns have been the most common, though we have seen several malware families delivered as well.

Most Common Delivery Mechanisms:

  • Attached spreadsheet or Word document delivering a second-stage malware executable
  • Attached archived executable
  • Embedded URLs delivering ransomware
  • Office macros
  • CVE-2017-11882
      • Auto-IT Dropper (which exploits CVE-2017-1882)

 

Malware Delivered:

·       Agent Tesla Keylogger ·       Ave_Maria Stealer ·       Black RAT ·       FormGrabber
·       Hakbit Ransomware ·       Hawkeye Keylogger ·       KPOT Stealer ·       Lime RAT
·       Loki Bot ·       NanoCore ·       Nemty Ransomware ·       Pony
·       Remcos RAT ·       SalityBot ·       TrickBot

 

Commonly Spoofed Organization Types:

  • World Health Organization
  • Centers for Disease Control
  • Other global/regional health organizations
  • Health related non-profits/medical associations
  • Federal, State and Local Departments of Health/Ministries of Health
  • Transportation companies
  • Shipping companies

Many COVID-19 phishing templates have been more convincing than your average phish. In one example, seen in Figure 1 below, threat actors hosted the logo of the spoofed organization on Google Drive and added an additional threat at the end of the email: a whopping $1,000 fine if the supposedly attached forms to approve travel outside of the home are not filled out by the recipient. The attachment delivers the information stealer KPOT via a VBS script to AutoIT dropper. The dropper uses legitimate Windows utilities to disguise its actions.

Figure 1: Coronavirus-Themed Email Delivers Complex Chain

Phishing Threat Landscape Future Changes

Coronavirus themes have predictably grown in popularity and will almost certainly continue to do so. These phishing campaigns are also likely going to adapt over time to incorporate related work from home, teleconference or videoconference invites or notices, government refund, unemployment filing, and online ordering themes. Some threat actors have already begun to do this, as shown in Figure 2, where threat actors used a “Work Remotely Enrollment (Action Required)” subject, spoofing internal Human Resources to deliver links to credential phishing pages hosted on Microsoft SharePoint. Additional  Coronavirus phishing email examples that evade email gateways are available on the Cofense Coronavirus Phishing Information Center. This center is continually updated with campaigns identified by Cofense Intelligence, and the related IOCs are sent to our customers daily.

Figure 2: Example Email with Coronavirus “Work From Home” Related Theme

If COVID-19 continues to affect business operations, it is likely this will affect the phishing threat landscape more broadly. While many organizations continue to maintain some operations, there are likely to be some longer-term shifts in normal business communications.  For example, an email about an office party or an in-person meeting is more likely to make employees suspicious than it would have previously.

These kinds of changes will also likely extend to our personal lives as well in the “stay home” era. An email about new concert tickets or in-store sales will likely raise a red flag. Simply causing individuals to pause for a few extra seconds because something seems suspicious may not seem particularly monumental. However, when users briefly break out of their ordinary mindsets, they gain the opportunity to report a link rather than click a link—a key component of effective phishing reporting programs. Although, as noted above, threat actors will almost certainly adapt as well in their phishing templates.

As Coronavirus continues to affect everyone, there will likely be a significant shift in the phishing threat landscape for the most common malware and phishing themes, even excluding specifically Coronavirus-related themes. Although there has been a massive shift to remote work, some organizations have minimal remote operations infrastructure. In order to operate, they have no choice but to allow some users to connect to infrastructure with a lowered accepted standard of security. Organizational responses to suspicious network or user behavior may also be complicated due to these changes. Previously, such incidents of suspicious network or user behavior could be dealt with by physically quarantining the computer and quickly supplying a replacement as incident response teams investigate the issue. Currently, this may not be possible if the only way the employee can contact work-related support is via their potentially compromised computer. More laborious responses may delay investigations and mitigations.

These kinds of scenarios are what makes it ever more important for organizations to ensure phishing prevention is as much a focus as post-compromise detection. Incident response and mitigation will certainly be more difficult as long as workforces need to remain dispersed.

 

How Cofense Can Help

Visit Cofense’s Coronavirus Phishing Infocenter to stay up to date as threats evolve. Our site is updated with screenshots and YARA rules as we continue to track campaigns.

 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.

Coronavirus Redefines the Phishing Threat Landscape

By Aaron Riley

Cofense Intelligence has seen a stark increase in phishing email campaigns relating to the COVID-19 pandemic that spoof trusted health services to deliver credential phishing or malware. Credential phishing makes up the majority of the campaigns analyzed, with the minority ranging from simple to complex delivery chain and malware samples. With some companies quickly adopting work-from-home (WFH) policies, threat actors are poised to take advantage of the newly created security gaps by playing on pandemic fears. The potential impact of these phishing campaigns, along with the current economic uncertainty, can be devastating to an organization.

As soon as threat actors began weaponizing this crisis in phishing emails, Cofense Intelligence published a Flash Alert reporting that the Centers for Disease Control and Prevention (CDC) and World Health Organization (WHO) were spoofed in a Coronavirus-themed phishing campaign to deliver the Agent Tesla keylogger. Since that alert, we have seen an increase in phishing campaigns that spoof organizations in aviation and other transportation industries.

Coronavirus-themed campaigns that deliver malware are starting to evolve in complexity as well. For example, the Agent Tesla keylogger campaign mentioned above was delivered via an email attachment, which would have been blocked by sandbox analysis. In comparison, the most recent campaign used a Microsoft Office Word document with the CVE-2017-11882 exploit, which delivered an AutoIT dropper that placed five different malware family samples onto the endpoint: Remcos RAT, Black RAT, Ave_Maria Stealer, Lime RAT, and Sality Bot. All five of these payloads are designed to steal information and provide persistent control to a threat operator, and only one needs to be successful in its attempts to compromise the machine.

Most organizations are not set up to have all employees work from home. As these organizations attempt to quickly develop their WFH business requirements, they might overlook security. An organization’s most reliable and hardened security features are typically within its physical facility and do not extend much beyond that domain. These security features include, but are not limited to, Network Access Control (NAC), content filtering, Data Loss Prevention (DLP), eavesdropping / Machine In The Middle (MITM) prevention, and update/patch management. With some of these security features effectively “bypassed” for the attacker in a WFH situation, organizations face an increased risk that a phishing campaign will impact them. A malicious incident or event could go unnoticed by overburdened IT administration and security teams for longer than normal periods.

Most of the newly created risk can be mitigated. Network Access Control can be done with a software agent on each endpoint attempting to connect to the organization. The agent communicates to an authoritative entity to prove the machine has the organization’s trusted certificate to connect to the internal network, is up to date with antivirus definitions, and is fully patched to the organization’s requirements. Mandatory network tunneling for the endpoint can mitigate the lack of content filtering, network DLP, and MITM security measures. A Virtual Private Network (VPN) connection to the enterprise network, which forces the network traffic through its egress and ingress points, will help cover the risk created by WFH employees—as long as employees do not reintroduce the vulnerability by turning off the VPN. These measures are effective but require resources and time to implement, which some organizations might find challenging while rapidly rolling out WFH.

Organizations need to educate their employees about the risk of Coronavirus-themed phishing attacks and, at the same time, ensure that employees do not dismiss legitimate information. Creating phishing simulation templates around the Coronavirus theme is not advised. Doing so could cause undue panic or add unnecessary noise. Instead, organizations should describe what to look for in Coronavirus phishing attempts and then explain how legitimate information will be communicated.

Cofense Intelligence anticipates the volume of Coronavirus-themed phishing campaigns will continue to increase in the near future and will target specific industry sectors such as healthcare, energy, and public services. These campaigns will make increased use of malware and will spoof a larger number of legitimate businesses. Security teams will need to act quickly to determine new WFH risks and the proper mitigations. Clear, concise communication and education, coupled with secure technology and the right implementation strategies, is the best way to secure the target base of these phishing attacks.

How Cofense Can Help

Visit Cofense’s Coronavirus Phishing Infocenter to stay up to date as threats evolves. Our site is updated with screenshots and YARA rules as we continue to track campaigns.

For Cofense Intelligence customers who would like to keep up with the Active Threat Reports and indicators being published, all COVID-19 campaigns are tagged with the “Pandemic” search tag.

Cofense Intelligence customers can also search up to date reports in ThreatHQ using the “Search Tags” field in the Search Form.

Indicators of Compromise
To view the full list of IOCs, click on the menu below to expand further.

36802, 36908, 36937, 36938, 36939, 36940, 36941, 36942, 36943, 36957, 37146, 37148, 37149, 37151, 37152, 37226, 37227, 37228, 37230

PM_Intel_Nemty_37230
PM_Intel_AgentTesla_37227
PM_Intel_AgentTesla_37226
PM_Intel_TrickBot_37151
PM_Intel_AgentTesla_37152
PM_Intel_Loki_37149
PM_Intel_Hawkeye_37148
PM_Intel_Hawkeye_37146
PM_Intel_AgentTesla_36802
PM_Intel_CredPhish_36943
PM_Intel_CredPhish_36942
PM_Intel_CredPhish_36940
PM_Intel_CredPhish_36939
PM_Intel_CredPhish_36938
PM_Intel_CredPhish_36937
PM_Intel_CredPhish_36941
PM_Intel_BlackRAT_36957
PM_Intel_Loki_36908

hxxp://euromopy[.]tech/etty/black/download/fre[.]php
hxxps://drive[.]google[.]com/uc?export=download&id=1V8530tZ-SNHELlaVL4BMQpJrRU2DBPSL
hxxps://gocycle[.]com[.]au/cdcgov/files/
hxxps://urbanandruraldesign[.]com[.]au/cdcgov/files/
hxxps://healing-yui223[.]com/cd[.]php
hxxps://onthefx[.]com/cd[.]php
hxxps://www[.]schooluniformtrading[.]com[.]au/cdcgov/files/
hxxp://my[.]pcloud[.]com/publink/show?code=XZO5BWkZjc6l5EBCtnkTYqw2DHqzEBT4LAay
hxxps://takemorilaw[.]com/wp-content/micro-update-1-2/
hxxp://www[.]dogogiaphat[.]com/ecdc[.]php
hxxps://www[.]scholarcave[.]com/owa/owa[.]php
hxxps://jetluxinc396[.]sharepoint[.]com/:b:/g/ERt-r1ZM6PRGhKdxb6bfZSIBcOX2b0y8snN4fg8f7z22rA
hxxps://southhillspros[.]com/citrix/Ward/broward[.]php
hxxps://southhillspros[.]com/Rovince/Jelink[.]html
hxxps://southhillspros[.]com/citrix/Ward/broward[.]htm
hxxps://wusameetings[.]tk/boding/Jelink[.]html
hxxps://noithatgoocchoav[.]com/cd[.]php
hxxps://www[.]brightparcel[.]com/corona/owa[.]php
hxxps://toyswithpizzazz[.]com[.]au/service/coronavirus/
hxxps://notmsg[.]smvm[.]xyz/
hxxp://sevgikresi[.]net/logof[.]gif
hxxp://datalinksol[.]com/logo[.]gif
hxxp://autocarsalonmobil[.]com/wp-content/uploads/Internetsonline[.]txt
hxxp://nlcfoundation[.]org/images/xs[.]jpg
hxxps://pastebin[.]com/raw/vnPLhhBH
hxxp://snsoft[.]host-ed[.]me/images/logos[.]gif
hxxp://edirneli[.]net/tr/logo[.]gif
hxxp://185[.]244[.]30[.]4:6669
hxxp://68[.]168[.]222[.]206/logos[.]gif
hxxp://babystophouse[.]com/images/logo[.]gif
hxxp://glamfromeast[.]com/image/logo[.]gif
hxxp://bit[.]ly/2TpOpNS
hxxp://natufarma[.]net/imagens/logof[.]gif
hxxp://mabdesign[.]unlugar[.]com/button[.]gif
hxxp://gardapalace[.]it/logo[.]gif
hxxp://hidroservbistrita[.]ro/images/logo[.]gif
hxxp://krupoonsak[.]com/logo[.]gif
hxxp://emrahkucukkapdan[.]com/img/button[.]gif
hxxp://onlinepreneur[.]id/license/love[.]exe
hxxp://onlinepreneur[.]id/manager/brain[.]exe
hxxps://site-inspection[.]com/[.]well-known/acme-challenge/w[.]php/9SG2m697HN
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=6350FGwOB6MQS5d7ZcXy
hxxps://114[.]8[.]133[.]71:449/red5/
hxxps://181[.]129[.]104[.]139:449/red5/
hxxps://51[.]89[.]73[.]158:443/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=lcasCwk4Qjbk8sBCAE8g
hxxps://194[.]5[.]250[.]150:443/red5/
hxxps://186[.]71[.]150[.]23:449/red5/
hxxps://107[.]172[.]191[.]12:443/lib698/
hxxps://46[.]17[.]107[.]65:443/lib698/
hxxps://64[.]44[.]51[.]113:447/red5/
hxxps://181[.]112[.]157[.]42:449/red5/
hxxps://212[.]80[.]217[.]220:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=WjL3jrVFwBBnlQp3xn8K
hxxps://185[.]14[.]31[.]252:443/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=PzKFqjTUgsVxfN2OL347
hxxps://46[.]4[.]167[.]250:447/lib698/
hxxps://172[.]245[.]156[.]138:443/lib698/
hxxps://180[.]180[.]216[.]177:449/lib698/
hxxps://203[.]176[.]135[.]102:8082/red5/
hxxps://146[.]185[.]253[.]122:447/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=hNRuyY0glKhPxpDGkhRh
hxxps://146[.]185[.]253[.]178:443/lib698/
hxxps://181[.]140[.]173[.]186:449/red5/
hxxps://36[.]89[.]85[.]103:449/red5/
hxxps://51[.]254[.]164[.]244:443/red5/
hxxps://194[.]5[.]250[.]150:443/lib698/
hxxps://185[.]244[.]39[.]65:447/red5/
hxxps://172[.]245[.]157[.]135:443/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=Yagk0Foy3wjdzOq6nQcP
hxxps://5[.]2[.]79[.]66:443/lib698/
hxxps://193[.]37[.]213[.]128:443/red5/
hxxps://185[.]99[.]2[.]221:443/lib698/
hxxps://146[.]185[.]253[.]179:447/red5/
hxxps://96[.]9[.]73[.]73:80/lib698/
hxxps://121[.]100[.]19[.]18:449/red5/
hxxps://185[.]99[.]2[.]140:447/lib698/
hxxps://195[.]123[.]239[.]67:443/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=bpj5AXSdClkWLG84Xv02
hxxps://185[.]62[.]188[.]159:443/lib698/
hxxps://181[.]140[.]173[.]186:449/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=xhyi95QEt2sH7ZGSl5FV
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=rOE8Tr0FuFXfSSUaDO6M
hxxps://146[.]185[.]253[.]122:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=rtvUCSO49CMSm2QTlDcH
hxxps://85[.]204[.]116[.]253:443/lib698/
hxxps://46[.]174[.]235[.]36:449/lib698/
hxxps://119[.]252[.]165[.]75:449/red5/
hxxps://146[.]185[.]253[.]176:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=YJZHjkZ5qSUBheGScz5O
hxxps://178[.]156[.]202[.]157:447/red5/
hxxps://194[.]5[.]250[.]69:443/lib698/
hxxps://146[.]185[.]253[.]178:443/red5/
hxxps://36[.]89[.]85[.]103:449/lib698/
hxxps://185[.]203[.]118[.]37:443/red5/
hxxps://119[.]252[.]165[.]75:449/lib698/
hxxps://4cao4pyxbarkxf4n[.]onion:448/red5/
hxxps://185[.]142[.]99[.]89:443/red5/
hxxps://180[.]180[.]216[.]177:449/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=GmZr9Sd6TdL9g237BJFd
hxxps://195[.]123[.]239[.]29:447/red5/
hxxps://104[.]168[.]96[.]122:447/red5/
hxxps://46[.]4[.]167[.]250:447/red5/
hxxps://46[.]174[.]235[.]36:449/red5/
hxxps://185[.]14[.]31[.]98:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=MXtg3z4uEXlCKNSMW10E
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1547738007155673&id=pTCpS2vUujsK8z3zXJ0L
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=nZLf5Zn5ckDvobxOozo2
hxxps://5[.]255[.]96[.]187:447/red5/
hxxps://190[.]119[.]180[.]226:8082/red5/
hxxps://185[.]99[.]2[.]221:443/red5/
hxxps://5[.]182[.]210[.]226:443/red5/
hxxps://192[.]210[.]226[.]106:443/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=1eufomiZKmEvZe8AXaZK
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=SgRoybJA35wuTbDNCEs7
hxxps://5[.]2[.]76[.]29:447/red5/
hxxps://96[.]9[.]77[.]142:80/red5/
hxxps://194[.]5[.]250[.]69:443/red5/
hxxps://85[.]143[.]221[.]183:447/lib698/
hxxps://96[.]9[.]73[.]73:80/red5/
hxxps://195[.]123[.]239[.]67:443/red5/
hxxps://202[.]29[.]215[.]114:449/red5/
hxxps://45[.]135[.]164[.]193:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=HJb3L1X7FaO9MFRM2xJW
hxxps://146[.]185[.]253[.]18:447/lib698/
hxxps://45[.]135[.]164[.]193:447/red5/
hxxps://103[.]94[.]122[.]254:8082/red5/
hxxps://186[.]232[.]91[.]240:449/lib698/
hxxps://96[.]9[.]77[.]142:80/lib698/
hxxps://64[.]44[.]51[.]124:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=UqKF7TJ4pK6nu55Nq5SR
hxxps://51[.]254[.]164[.]244:443/lib698/
hxxps://51[.]89[.]73[.]158:443/red5/
hxxps://23[.]94[.]185[.]27:446/response/rcrd[.]php?s=1584097681876834
hxxps://46[.]17[.]107[.]65:443/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=YNsg198eIe2CENiLH2Q6
hxxps://103[.]94[.]122[.]254:8082/lib698/
hxxps://85[.]204[.]116[.]253:443/red5/
hxxps://185[.]62[.]188[.]159:443/red5/
hxxps://217[.]12[.]209[.]200:443/red5/
hxxps://192[.]210[.]226[.]106:443/red5/
hxxps://146[.]185[.]219[.]63:443/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=uOggu83wFMsZgJy2gYXR
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=KTjaFGA6rzAIRhzYpxsn
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=7aybmyzTyxjVkmAgca3q
hxxps://181[.]129[.]134[.]18:449/lib698/
hxxps://103[.]84[.]238[.]3:80/red5/
hxxps://36[.]89[.]106[.]69:80/red5/
hxxps://64[.]44[.]51[.]113:447/lib698/
hxxps://5[.]255[.]96[.]187:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=f2hUQzGxBwEot8ExHJ1m
hxxps://185[.]20[.]185[.]76:443/red5/
hxxps://198[.]23[.]252[.]127:447/lib698/
hxxps://185[.]216[.]35[.]10/3/L2KSUN[.]php
hxxps://146[.]185[.]253[.]18:447/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=Vs9fOJw0UArIH5NRL2Fi
hxxps://172[.]245[.]156[.]138:443/red5/
hxxps://114[.]8[.]133[.]71:449/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=LcVEiKUW9394wikl1RmW
hxxps://170[.]238[.]117[.]187:8082/lib698/
hxxps://185[.]14[.]31[.]97:443/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=YCZPUzOj6gGO3b0oxZXp
hxxps://193[.]111[.]62[.]50:447/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=eVMWyxkROwNbwzrByPGK
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=qVO7FmnWdv3CqlwU53XE
hxxps://5[.]182[.]210[.]226:443/lib698/
hxxps://195[.]123[.]239[.]29:447/lib698/
hxxps://202[.]29[.]215[.]114:449/lib698/
hxxps://181[.]196[.]207[.]202:449/red5/
hxxps://188[.]120[.]242[.]75:447/lib698/
hxxps://85[.]143[.]221[.]183:447/red5/
hxxps://121[.]100[.]19[.]18:449/lib698/
hxxps://186[.]232[.]91[.]240:449/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=gKmNNEREiPRIKGQp2dmg
hxxps://170[.]238[.]117[.]187:8082/red5/
hxxps://46[.]4[.]167[.]242:447/red5/
hxxps://62[.]109[.]11[.]248:447/lib698/
hxxps://190[.]214[.]13[.]2:449/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=tN8O8VDbWyHtPRydtWy0
hxxps://198[.]15[.]82[.]162:443/red5/
hxxps://170[.]84[.]78[.]224:449/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=NlWlLA26RToHt8mTsgOI
hxxps://198[.]23[.]252[.]127:447/red5/
hxxps://185[.]99[.]2[.]140:447/red5/
hxxps://200[.]21[.]51[.]38:449/lib698/
hxxps://104[.]168[.]96[.]122:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=eMimeUZPy76ZHmG1apBW
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=nN2EWQAMeD3cg32aDQtJ
hxxps://188[.]209[.]52[.]162:443/red5/
hxxps://181[.]112[.]157[.]42:449/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=j3x1pd2ADExKICKojgcV
hxxps://186[.]71[.]150[.]23:449/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=IqS9Lp3Qs0uILRwyvocO
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=8ldKgFEC3ev2pLmqqKYu
hxxps://31[.]131[.]21[.]168:447/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=qAfHjNJAMHs8TCAv8VAY
hxxp://142[.]93[.]22[.]0:80/
hxxps://200[.]21[.]51[.]38:449/red5/
hxxps://5[.]255[.]96[.]186:447/red5/
hxxps://200[.]127[.]121[.]99:449/red5/
hxxps://5[.]2[.]79[.]66:443/red5/
hxxps://185[.]99[.]2[.]137:443/lib698/
hxxps://51[.]254[.]164[.]245:443/red5/
hxxps://185[.]99[.]2[.]137:443/red5/
hxxps://64[.]44[.]51[.]124:447/red5/
hxxps://177[.]74[.]232[.]124:80/red5/
hxxps://200[.]127[.]121[.]99:449/lib698/
hxxps://171[.]100[.]142[.]238:449/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=juhyLxqVBnei6qmSsjZ7
hxxps://178[.]156[.]202[.]157:447/lib698/
hxxps://172[.]245[.]157[.]135:443/lib698/
hxxps://185[.]99[.]2[.]115:443/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=HMucklYySnPDh9NWPo2h
hxxps://217[.]12[.]209[.]200:443/lib698/
hxxps://185[.]244[.]39[.]65:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=gjBKrgh9ZivFEv6OnkVg
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=QKf1HHY4dLUK3t2czTR3
hxxps://31[.]131[.]21[.]168:447/lib698/
hxxps://103[.]84[.]238[.]3:80/lib698/
hxxps://177[.]74[.]232[.]124:80/lib698/
hxxps://203[.]176[.]135[.]102:8082/lib698/
hxxps://181[.]129[.]104[.]139:449/lib698/
hxxps://131[.]161[.]253[.]190:449/lib698/
hxxps://188[.]120[.]242[.]75:447/red5/
hxxps://181[.]196[.]207[.]202:449/lib698/
hxxps://62[.]109[.]11[.]248:447/red5/
hxxps://36[.]89[.]106[.]69:80/lib698/
hxxps://198[.]15[.]82[.]162:443/lib698/
hxxps://181[.]113[.]28[.]146:449/lib698/
hxxps://185[.]14[.]31[.]98:447/red5/
hxxps://185[.]142[.]99[.]89:443/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=93vdwyq6sh9oBUrUmnzS
hxxps://107[.]172[.]191[.]12:443/red5/
hxxps://185[.]203[.]118[.]37:443/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=IJgYwiMilRq9dmvYXx5O
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=oViUuJw2ydNIx3h3QEYd
hxxps://46[.]4[.]167[.]242:447/lib698/
hxxps://5[.]2[.]76[.]29:447/lib698/
hxxps://146[.]185[.]219[.]63:443/lib698/
hxxps://190[.]100[.]16[.]210:8082/lib698/
hxxps://23[.]94[.]185[.]27:446/response/rcrd[.]php?s=1547738007155673
hxxps://4cao4pyxbarkxf4n[.]onion:448/lib698/
hxxps://112[.]78[.]164[.]34:8082/lib698/
hxxps://185[.]99[.]2[.]115:443/lib698/
hxxps://45[.]148[.]120[.]153:443/lib698/
hxxps://193[.]37[.]213[.]128:443/lib698/
hxxps://45[.]148[.]120[.]153:443/red5/
hxxps://190[.]214[.]13[.]2:449/lib698/
hxxps://185[.]20[.]185[.]76:443/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=d4wYKmoNAL4jbXsWnwNP
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=uCQHZmGWTLLlfhfR94Wj
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=kpmcigmW4tIXJAliL5SP
hxxps://5[.]255[.]96[.]186:447/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=9kgyvNnUnLXBHKxfhR76
hxxps://131[.]161[.]253[.]190:449/red5/
hxxps://185[.]14[.]31[.]97:443/lib698/
hxxps://188[.]209[.]52[.]162:443/lib698/
hxxps://185[.]14[.]31[.]252:443/lib698/
hxxps://212[.]80[.]217[.]220:447/red5/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=hhHR67XuY9k7vxRMdwoh
hxxps://193[.]111[.]62[.]50:447/lib698/
hxxps://170[.]84[.]78[.]224:449/lib698/
hxxps://112[.]78[.]164[.]34:8082/red5/
hxxps://181[.]129[.]134[.]18:449/red5/
hxxps://146[.]185[.]253[.]179:447/lib698/
hxxps://190[.]100[.]16[.]210:8082/red5/
hxxps://146[.]185[.]253[.]176:447/red5/
hxxps://190[.]119[.]180[.]226:8082/lib698/
hxxps://171[.]100[.]142[.]238:449/lib698/
hxxps://181[.]113[.]28[.]146:449/red5/
hxxps://51[.]254[.]164[.]245:443/lib698/
hxxps://23[.]94[.]185[.]27:446/response[.]php?s=1584097681876834&id=O6D4aGfNwIxDT5OfEo9d
hxxp://uzoclouds[.]eu/dutchz/dutchz[.]exe
hxxp://bibpap[.]com/1g7/pin[.]php
hxxp://posqit[.]net/TT/50590113[.]exe
hxxp://bitly[.]ws/83FN
hxxp://nemty[.]top/public/pay[.]php
hxxp://nemty10[.]biz/public/gate[.]php
hxxps://marsdefenseandscience[.]com/reports[.]zip
hxxp://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad[.]onion/public/pay[.]php

euromopy[.]tech
wusameetings[.]tk
emrahkucukkapdan[.]com
gardapalace[.]it
snsoft[.]host-ed[.]me
cornerload[.]dynu[.]net
seasonsnonaco[.]ddnsking[.]com
datalinksol[.]com
nlcfoundation[.]org
sevgikresi[.]net
autocarsalonmobil[.]com
seasons444[.]ddns[.]net
krupoonsak[.]com
natufarma[.]net
edirneli[.]net
mabdesign[.]unlugar[.]com
babystophouse[.]com
glamfromeast[.]com
hidroservbistrita[.]ro
onlinepreneur[.]id
onlinepreneur[.]id
site-inspection[.]com
uzoclouds[.]eu
bibpap[.]com
posqit[.]net
zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad[.]onion
nemty10[.]biz
marsdefenseandscience[.]com
nemty[.]top

45[.]64[.]97[.]178

185[.]216[.]35[.]10

ef07feae7c00a550f97ed4824862c459
05adf4a08f16776ee0b1c271713a7880
29e8800ebaa43e3c9a8b9c8a2fcf0689
970bc68378526981f7b470b014e4a61d
648a2da84b857520830981af55bbd4f2
e36b292de6db73e78f77ea2fed092848
dca53f253066ff1736d9735e0e4f861b
ecdcf6e29f917239ecd9f3c4cd4bd4b4
4ad1b0398bc3a371a82923383de2d0a4
54fb481530500d781d0aa282e8524016
0c6fa100c0fd612d9f55a87017989621
457d4329b66efcbd6bcba521502df6a8
6053a2d672f9f9bd5cd0725d4b106493
c1ab6a9a559d54c071eb110235f77fe2
be950f0aaa6654c30532168a3f82d4e6
33498c2e5ce532fdbcabfc2caa882e04
ca0951249ef447ca0443ebf519b7ec7e
24cabc6a0a02674fc6a1e778cd265ecc
d6557715b015a2ff634e4ffd5d53ffba
2858a05f4ec255cb383db26019720959
4e9aa334811b6a4fa6542483a34fc9c5
caf133755a01fea99b323e3fa1965705
c6f8278ee29471ce84b4f6bb148161de
1f7ff50f672288616ef80220ab41cddc
ef991e614208324eecb10831f0b6990d
93109ef58dc7fa86e2cb186e8d8cfc8a
8f9c95b359a574f16801184b095a027d
ba0b4e05e3b26e26f2e0793b9190ba2c
f4d2bdeeb7c5c3eac0afe845b988b31a
a39694b7311fc2d0991d6f7aa4d22460
d9822e032bb6f0d39aba533ba5b50dca
ba6a13ad9f673e365580b389a7297611
64574f1a3b4d554322279a238c7943f1
8aa849595f1065dce6488dcff4caa043
34b9244ead7f1d1d4a94e04a05d8f474
222d2f0dcae9889174e500fea7655b9a
811e21aadc64bbbedaa2d616bd258f58
4ed0cbc8dc2c3208bf760976d854b276
1cd9c1348db93cd674066f566740d697
3a7d8ab97cc7cacdc6b613632f79ae36
777250fb412071ab4b655883de6b888b
fa1ed07a84d0f6db0560edffc0f5cd0c
cc24481d8673278c9ca9a427aebfaf30
a98c28d9666e6050b2c76d0062342078
62ded00158221fd7b3e678b9d9edbd7b
ecf4c248beb954f59901bba955646c19
64574f1a3b4d554322279a238c7943f1
62025fefd240ac80326db825903da90e
2f1ac455d1c6e2a3f3e0d1137b047696
a5a2a55b29d20a684b09e40d4480029d
022e42a2ad49f8428f34435b595c7216
08dd5ee67ee69ddfa11cb55562baef58
e7351df51633435293ddc09de7fdc57c
1179a7989031fc4b6331505b388dcb12
378bbb172ccae5e28549a003e4e84bce
07d718b0b7f2bbe0ea001c76aca82b7d
f221f92d7f8ccb7133f58ae1a3f4257c
501318d315ba07554f92ff13ebb075c2
b57d2c252746baff47e12b4021a75ba4

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.