Full Report
Playbook of Microsoft Document Sharing-Based Phishing Attack
Analysis Summary
# Tool/Technique: Microsoft Document Sharing-Based Phishing (Appspot/BlueMix Redirector)
## Overview
This attack involves a multi-stage phishing campaign that abuses legitimate cloud document-sharing services (such as Microsoft Sway, SharePoint, and OneNote) to bypass email security filters. The technique uses intermediary redirectors hosted on legitimate Google App Engine (`appspot.com`) and IBM Cloud (`mybluemix.net`) domains to lead victims to a sophisticated credential-harvesting phishing kit.
## Technical Details
- **Type**: Phishing Technique / Credential Harvesting Framework
- **Platform**: Cross-platform (Web-based)
- **Capabilities**: Bypassing Secure Email Gateways (SEGs), hosting phishing infrastructure on reputable cloud domains, harvesting Microsoft 365/Outlook credentials, and automated data exfiltration.
- **First Seen**: Identified actively around September 2019, with versions tracked through early 2020.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0005 - Defense Evasion]**
- [T1564.004 - Hide Artifacts: Steganography / Obfuscation] (via legitimate cloud redirects)
- [T1078 - Valid Accounts] (Harvesting credentials for subsequent access)
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery] (Gathering browser/IP data via phishing kit)
## Functionality
### Core Capabilities
- **Legitimate Service Abuse**: Uses Microsoft Sway or SharePoint to host the initial lure, ensuring the email contains a link to a trusted `microsoft.com` domain.
- **Multi-tier Redirection**: Employs Google App Engine (`*.appspot.com`) and IBM BlueMix (`*.mybluemix.net`) as redirectors to mask the final destination of the phishing page.
- **Credential Harvesting**: Sophisticated login clones for Microsoft services designed to capture usernames and passwords.
### Advanced Features
- **Phishing Kit Versioning**: The framework uses internal version strings (e.g., `billgates_03.10.2020`) suggesting a modular or "Phishing-as-a-Service" (PhaaS) model.
- **Automated Exfiltration**: Stolen credentials are sent to centralized data-harvesting servers (e.g., `bestnewsworld[.]info`).
- **Reputation Hijacking**: By utilizing App Engine and BlueMix, the attackers leverage the high domain reputation of Google and IBM to evade URL filtering and blacklists.
## Indicators of Compromise
### Network Indicators (Defanged)
**Intermediary Redirectors (Appspot/BlueMix):**
- `kj65rdasz.appspot[.]com`
- `tu4dff-reflective-shark.eu-gb.mybluemix[.]net`
- `ty65xcc-smart-manatee.mybluemix[.]net`
- `uy054eprsdoz.appspot[.]com`
- `y56gcvx-lean-bear-up.mybluemix[.]net`
- `ruw82qpzxas.appspot[.]com`
**Data Harvesting Servers:**
- `odaiw3dda.bestnewsworld[.]info`
- `otpe.bestnewsworld[.]info`
- `uy6x.c3y5-tools[.]com`
### Behavioral Indicators
- Emails containing links to Microsoft Sway or SharePoint that immediately prompt for a login via an external redirect.
- Web traffic transitioning from a legitimate Microsoft domain to an `appspot.com` or `mybluemix.net` sub-domain before hitting an unknown TLD.
## Associated Threat Actors
- While specific named groups (e.g., APTs) are not explicitly linked, the kit versions (e.g., `billgates`, `anthony`, `dumpoker`) suggest a widespread cybercriminal operation or a specific kit developer selling to multiple affiliates.
## Detection Methods
- **Behavioral Detection**: Monitor for unusual traffic patterns where users visit `appspot.com` or `mybluemix.net` immediately following a click in a Microsoft-hosted document.
- **Email Filtering**: Inspect internal Microsoft-hosted documents (Sway/SharePoint) for outbound links to cloud hosting providers.
- **YARA/Signature**: Scan for phishing kit version strings (listed in Part D of the context) within captured network traffic or HTML content.
## Mitigation Strategies
- **Multi-Factor Authentication (MFA)**: Implementing FIDO2 or hardware-based MFA to mitigate the impact of harvested credentials.
- **Domain Blocking**: Restrict or closely monitor traffic to subdomains of `appspot.com` and `mybluemix.net` that do not align with known business applications.
- **User Training**: Educate users on the "multi-step" nature of modern phishing, emphasizing that legitimate Microsoft documents should not redirect through multiple third-party cloud services to reach a login page.
## Related Tools/Techniques
- **Phish-on-Sway**: A general technique involving Microsoft Sway lures.
- **Living off Trusted Sites (LOTS)**: The broader strategy of using reputable cloud services for malicious infrastructure.