Full Report
Group-IB's Computer Emergency Response Team built a solid phishing kit database, which helps Group-IB fight phishing that targets specific brands.
Analysis Summary
# Tool/Technique: Phishing Kits with Embedded Backdoors
## Overview
Phishing kits are ready-to-use archives containing the necessary scripts (PHP, HTML, JS) to deploy fraudulent websites. Modern phishing kits, as analyzed by Group-IB, frequently include "backdoors" or hidden functionalities designed to benefit the kit's developer. These tools not only facilitate credential theft from end-users but also allow the original developers to compromise the hosting servers used by their customers (other scammers) and exfiltrate stolen data to secondary locations.
## Technical Details
- **Type:** Attack Tool / Phishing Framework
- **Platform:** Web Servers (primarily PHP-based)
- **Capabilities:** Credential harvesting, automated data exfiltration, anti-analysis (anti-bot), remote server management (web shells).
- **First Seen:** Ongoing; kits are continuously evolved by developers.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0003 - Persistence]**
- [T1505.003 - Server Software Component: Web Shell]
- **[TA0007 - Discovery]**
- [T1016 - System Network Configuration Discovery] (via Anti-bot scripts)
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel] (via hidden email/Telegram exfiltration)
## Functionality
### Core Capabilities
- **Credential Harvesting:** Capturing usernames, passwords, and PII from victims.
- **Data Exfiltration:** Sending captured data via email or Telegram bots to the operator.
- **Anti-Bot/Anti-Analysis:** Using `antibot.php` scripts to block known IP addresses, User-Agents, or hostnames associated with security researchers and crawlers.
### Advanced Features
- **Embedded Web Shells:** Integrating scripts (e.g., within `robots.php`) that allow terminal command execution, file uploads, and password brute-forcing on the hosting server.
- **Secondary Exfiltration ("Backdoors"):** Developers often hardcode additional email addresses or API tokens to receive a copy of all data stolen by the kit's buyer.
- **Dynamic Payload Loading:** Assembling URLs (e.g., from Pastebin) piece-by-piece to download additional malicious components, avoiding static detection.
- **Obfuscation:** Using encoding and simple algorithms to hide malicious web shell code behind legitimate-looking lure text or within seemingly benign files.
## Indicators of Compromise
- **File Names:** `robots.php`, `antibot.php`, `gate.php`, `config.php`.
- **Hash (Web Shell Password):** `aafedc957d39b975c5d15413825b033f` (SHA1/MD5 variant).
- **Network Indicators:**
- Links to `pastebin[.]com` (used for hosting malicious code fragments).
- Telegram Bot API endpoints (`api[.]telegram[.]org/bot<token>/sendMessage`).
- **Behavioral Indicators:**
- PHP scripts executing shell commands (`system`, `exec`, `passthru`).
- Unexpected outbound connections from a web server to unauthorized email providers or messaging APIs.
## Associated Threat Actors
- Phishing Kit Developers (often selling "commoditized" cybercrime tools).
- Affiliate-based scam groups.
## Detection Methods
- **Signature-based detection:** Scanning for known web shell strings and obfuscation patterns in uploaded web files.
- **Behavioral detection:** Monitoring for unauthorized file creation within web directories and unusual outbound traffic patterns from the web server.
- **YARA rules:** Rules targeting specific anti-bot arrays and disassembled URL strings used in common kits.
## Mitigation Strategies
- **Prevention:** Use Digital Risk Protection (DRP) services to identify and take down phishing domains before they gain traction.
- **Server Hardening:** Disable dangerous PHP functions (`eval`, `exec`, `system`) in `php.ini`.
- **Access Control:** Implement strict file permissions to prevent scripts from writing to unauthorized directories.
- **Monitoring:** Regularly audit web server logs for suspicious POST requests and file changes.
## Related Tools/Techniques
- **Web Shells:** WSO, Alfa Shell (similar functionality to embedded kit shells).
- **Phishing-as-a-Service (PhaaS):** The broader ecosystem where these kits are traded.
- **Typosquatting:** Often used in conjunction with these kits to lure victims.