[vc_row][vc_column animation_iteration=”1″][mvc_infobox info_style=”mega_info_box_2″ info_opt=”show_icon” icon_size=”35″ icon_height=”75″ icon_radius=”15px” border_width=”2″ title_color=”#cd202c” font_icon=”fa fa-exclamation-triangle” icon_color=”#cd202c” border_clr=”#dd3333″ info_title=”Phishes Found in Environments Protected by SEGs” title_size=”25″ css=”.vc_custom_1588795526163{margin-top: 20px !important;margin-bottom: 30px !important;}” hoverclr=”#cd202c” icon_bg=”#ffffff” hoverbg=”#ffffff”]
Microsoft 365 ATP
Microsoft 365 EOP
Symantec
[/mvc_infobox][/vc_column][/vc_row][vc_row][vc_column][vc_column_text c_id=”.vc_1588797515847″]By Ashley Tran, Cofense Phishing Defense Center
From prime ministers, members of congress to celebrities and staff of nursing homes — many have been affected by COVID-19. And the worst part? Threat actors know this and are heavily weaponizing this pandemic, exploiting the fears and concerns of users everywhere. The Cofense Phishing Defense Center (PDC) has observed a new phishing campaign found in environments protected by Microsoft and Symantec that not only impersonates a company’s management but also suggests that a fellow employee has tested positive for the disease, urging users to read an enclosed malicious attachment posed as “guidelines” or “next steps.”
As we have seen before and noted in previous Cofense blogs and media stories, Coronavirus themed phishing attacks are running rampant and attacking users across all industries. Although the attacks vary in method, the main takeaway is the same: all users must exercise the utmost caution and restraint in the face of emotionally jarring emails.[/vc_column_text][vc_single_image image=”19373″ img_size=”large” alignment=”center” onclick=”link_image”][vc_empty_space][vc_single_image image=”19372″ img_size=”large” alignment=”center” onclick=”link_image”][vc_empty_space][vc_single_image image=”19357″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588874960128″]
Figures 1-3: Email Bodies
The PDC has found multiple instances of this attack and a trend among them all. As demonstrated in Figures 1-3, the email subject lines are relatively similar: “Staff Member Confirmed COVID 19 Positive ID,” followed by a random string of numbers and that day’s date. The emotion these subject lines evoke in users are also the same: fear and curiosity. Emails appearing to be a “Team Update on COVID 19” and bearing their company’s name can convince end users to believe the email was sent internally. However, the true senders are revealed via the return paths:
Maga[@]tus[.]tusdns[.]com and ungrez[@]ssd7[@]linuxpl[.]com
Admittedly these emails would appear suspicious to most, but the threat actor is relying on the emotional subject line to overcome logic and push users to read just the first line of the sender information and nothing more.
The bodies of the emails have more variety and are worded differently, but the same main point: a fellow employee has the virus, so read this guideline we’ve attached to get more details or at least learn the “next steps” to take. To top it off the email is signed by “Management.”
The true part of this attack lies within the HTML file found in the email.
Figure 4 shows that the attachment has been detected as malicious by a multitude of services, however users won’t see this when they read the email.[/vc_column_text][vc_single_image image=”19359″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588792353357″]
Figure 4: VirusTotal Analysis
[/vc_column_text][vc_single_image image=”19375″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588792391851″]
Figure 5: Phishing Page
Upon opening the attachment users are presented with a generic Microsoft login page, a frequently targeted brand. The difference with this phish, however, is the threat actor has superimposed the login box over a blurred document that may appear to users as the previously mentioned “guidelines” lending an even greater sense of legitimacy.
The email of the recipient is automatically appended to the username field via code in the HTML. In fact, the threat actor has painstakingly put the base64 for each of the recipient’s email addresses, which is then translated to a readable format when interacting with the phish. This snippet of code can be observed in Figure 6.[/vc_column_text][vc_single_image image=”19361″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588793698877″]
Figure 6: Email Bodies
Once a user navigates to the next page and inputs their password, the information is then sent to the compromised site:
hxxp://tokai-lm[.]jp/style/89887cc/5789n[.]php?98709087-87634423
This exchange of information can be viewed by opening developer tools on any browser and navigating to the networking tab as shown in Figure 7.[/vc_column_text][vc_single_image image=”19374″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588792497907″]
Figure 7: Phishing Page
The code found within the HTML file that hosts the phishing content employs typical malicious tactics. For example, as seen in Figure 8, the code does not look like a typical HTML code. This is because the threat actor has attempted to obfuscate their code, to make analysis as well as detection harder. However, this is nothing new for phishing campaigns that choose to utilize a HTML file. De-obfuscating the code and revealing some its methods is not difficult.[/vc_column_text][vc_single_image image=”19376″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588792643553″]
Figure 8: Obfuscated Code
To begin, the code is notably broken into different parts. Each of these parts may stand out to anyone with an eye for encoding as being Hex text and base64. These both can easily be decoded back into their original form, the true HTML code, by utilizing tools such as RapidTables and Base64 Decode.[/vc_column_text][vc_single_image image=”19377″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588792730061″]
Figure 9: De-obfuscated Code
After de-obfuscating the code, the true HTML is seen in Figure 9, revealing the threat actor has compromised, or at the very least utilized, a compromised site to host the style sheet for their phish:
hxxp://ibuykenya[.]com/vendor/doctrine/styles[.]css[/vc_column_text][vc_single_image image=”19367″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588792775140″]
Figure 10: Open Directory with Phish Resource Files
The following is the directory which the threat actor has used to store the style sheet for the phish, along with what appears to be two additional files, based on their last modified dates.
Within the code, the image seen in the background of the document can also be recovered. The image is hosted on ImgBB, yet another relatively benign image hosting site to which threat actors flock to host images for their attacks.
hxxps://i[.]ibb[.]co/dMcjCWC/image[.]png[/vc_column_text][vc_single_image image=”19363″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588792858504″]
Figure 11: Document Preview from Phish
Upon closer observation, the title of the document can be obtained. With a quick search, the image the threat actor has used to further legitimize this login page in the eyes of the user can be linked back to the legitimate document found in Figure 12.[/vc_column_text][vc_single_image image=”19368″ img_size=”large” alignment=”center” onclick=”link_image”][vc_column_text c_id=”.vc_1588875014935″]
Figure 12: Legitimate Document Utilized by Threat Actor
All these steps – the social engineering, the obfuscated code, use of official COVID health advisories and more-are designed to ensure users don’t detect the phishing attack is in progress. This phish also demonstrates the attacker’s need to employ layered techniques designed to avoid detection by email gateways, as well as the incident responder’s need for the right investigative tools to properly analyze, detect and quarantine this threat.
| Network IOC | IP |
| hxxp://tokai-lm[.]jp/style/89887cc/5789n[.]php?98709087-87634423 | 150[.]60[.]156[.]116 |
How Cofense Can Help
Visit Cofense’s Coronavirus Phishing Infocenter to stay up to date as threats evolve. Our site is updated with screenshots and YARA rules as we continue to track campaigns.
All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.
[/vc_column_text][/vc_column][/vc_row]
