Targeted Phishing Linked to 'The Com' Surges

Analysis of the Hypertext Markup Language (HTML) pages that contain the sign-in form revealed the action attribute in the form element specifying the URL of the server-side script responsible for processing submitted data. When a user fills out the form and presses the “submit” button, the collected data is sent to a script via the "POST" HTTP method. Additionally, we observed the label "okta-signin-username" purposefully was associated with terms commonly used in legitimate login forms for company employees, such as “User ID,” “SSO ID” or “Username [LAN ID].” This observation suggests the attackers likely conducted preliminary research before creating the phishing pages, aiming to closely mimic the original login pages as much as possible to convincingly deceive employees.

After victims input their login details, they are requested to enter their Okta verification code on a subsequent page structured as https://[BRAND] + [LURE]/factor.html. The new page was designed to harvest MFA codes from victims via another POST request.

Another notable technical element used to track the subject phishing kit consisted of a URL at the bottom of the HTML pages listing a subdomain with an offensive word. Members of “The Com” are known for using inappropriate language while interacting with victim organizations.

Regarding the infrastructure services used, the individuals or groups orchestrating these campaigns predominantly relied on AS-Choopa. Adversaries very likely rented virtual private server (VPS) infrastructure from Vultr, Namecheap, DigitalOcean, BLNWX and Unified Layer to host the phishing infrastructure.

These actors used Hosting Concepts BV for domain registration. We previously observed threat actors rely on other services such as Namecheap, Hostinger or DigitalOcean.

The domains were registered following specific naming conventions, such as incorporating a reference to the impersonated organization or appending a dash ahead of common business and IT terms such as “workspace,” “dev,” “plus,” “hr” or “sso.” The terms "hr" and "sso" each were responsible for 37% of all domains registered, indicating a significant focus on these areas in the naming convention of the phishing sites.

In every campaign we observed, employees of the targeted organizations received SMS messages that contained links to phishing sites that closely resemble the Okta authentication pages of their respective organizations. The smishing campaigns occurred with a certain preference for Thursdays and Fridays after working hours and leveraging HR-related themes to lure victims. We included the theme of an observed phishing campaign for reference.

Victimology

Analysis of the targeted sectors revealed entities within the telecommunications industry were targeted the most, followed by the technology, insurance, IT or technology consulting and retail industries. We observed 20 companies targeted.

Assessment

Our investigation into these recent campaigns revealed overlaps to previous operations linked to the Scattered Spider and other intrusion clusters. However, as we previously reported, Scattered Spider has become a catch-all term within the cyber threat intelligence (CTI) industry and informs patterns observed from multiple intrusions, which are not always performed by the same individuals. Consequently, multiple individuals or groups replicating techniques and tools likely are behind the reported phishing infrastructure. The decision to employ an HR theme in SMS phishing and the selection of related domains likely stems from the understanding that many companies conduct employee performance reviews toward the year's end. Therefore, employees might be more inclined to perceive requests to access the HR portal as legitimate during this period. This evidence, along with reporting from other members of the CTI community, punctuates the effectiveness of these hacking operations and demonstrates the methods used to quickly gain initial access and persistence to victim organizations. With the continued success of these campaigns and the limited resources required to conduct them, it is almost certain these threat actors will continue to leverage similar social-engineering techniques for initial access and likely will inspire other threat actors to adopt the same. Despite the focus of the CTI industry squarely on this threat cluster, there appears to be little change in tactics, techniques and procedures (TTPs), which suggests mitigations to guard against attacks have had limited success and that the user remains the weakest link in the security chain.

Recommendations

Phishing is one of the most common attack vectors cybercriminals use. Common mitigation strategies organizations can implement according to the MITRE Detection, Denial and Disruption Framework Empowering Network Defense (D3FEND) knowledge graph of cybersecurity measures include:

Harden

• MFA: Though these intrusion clusters are effective at circumventing MFA, it still provides a useful layer of security that can delay an actor gaining access to a network.

• User account permissions: Maintaining a minimal permissions list affords defense in depth, meaning only a select few credentials will provide meaningful access without privilege escalation.

Detect

• URL analysis: Scrutinize URLs to ensure they are legitimate and if uncertain pass them to the security team for further analysis.

• User behavior analysis: Establishing a baseline for user behavior allows security teams to identify irregular activity.

Prevent

• User awareness: Train users to identify phishing pages and confirm they are accessing a legitimate website operated by the organization.

MITRE ATT&CK techniques

This report uses the MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) framework.