Full Report
Over 130 organizations have been compromised in a sophisticated attack using simple phishing kits
Analysis Summary
# Incident Report: 0ktapus Phishing Campaign
## Executive Summary
A sophisticated and widespread phishing campaign, dubbed "0ktapus," successfully compromised over 130 organizations by targeting employees with SMS-based phishing (smishing) links. The attackers utilized simple yet effective phishing kits designed to mimic Okta authentication pages to steal credentials and Two-Factor Authentication (2FA) codes. The primary goal was to gain unauthorized access to corporate networks and downstream systems, resulting in significant data breaches at high-profile entities like Twilio and Cloudflare.
## Incident Details
- **Discovery Date:** August 2022 (Public disclosure by Group-IB)
- **Incident Date:** July – August 2022
- **Affected Organizations:** 130+ organizations (including Twilio, Cloudflare, Mailchimp, DoorDash)
- **Sector:** Technology, Telecommunications, Finance, and Business Services
- **Geography:** Global, with a heavy focus on United States-based organizations
## Timeline of Events
### Initial Access
- **Date/Time:** Campaigns intensified starting in late July 2022.
- **Vector:** SMS Phishing (Smishing).
- **Details:** Employees received SMS messages warning that their password had expired or their account required attention, providing a link to a fraudulent login page.
### Lateral Movement
- Attackers used stolen Okta credentials and real-time 2FA codes to log into corporate SSO portals. From there, they accessed internal applications, customer support consoles, and source code repositories.
### Data Exfiltration/Impact
- **Twilio:** Attackers accessed internal systems and read the data of approximately 125 customers.
- **Cloudflare:** Attempted breach; however, hardware-based security keys (FIDO2) prevented the attackers from gaining access despite having valid credentials.
- **General:** Targeted organizations saw unauthorized access to internal communications and customer databases.
### Detection & Response
- **Discovery:** Multiple security teams identified a pattern of suspicious logins originating from unrecognized IP addresses linked to a common phishing kit.
- **Response Actions:** Affected companies revoked compromised sessions, forced password resets, and alerted impacted customers. Security researchers tracked the Command and Control (C2) infrastructure to map the full scope of 130+ victims.
## Attack Methodology
- **Initial Access:** Smishing (SMS Phishing) using URLs that mimicked company-specific Okta portals.
- **Persistence:** Maintaining active sessions in compromised SSO environments.
- **Privilege Escalation:** Accessing administrative consoles and internal tools via hijacked employee sessions.
- **Defense Evasion:** Using legitimate-looking domains (e.g., `t-mobile-okta[.]com`) and rotating IP addresses for phishing hosting.
- **Credential Access:** Phishing kits designed to capture usernames, passwords, and 2FA tokens in real-time.
- **Discovery:** Reconnaissance on employee phone numbers and organizational structures via public sources (LinkedIn/Data aggregators).
- **Lateral Movement:** Transitioning from the SSO portal to internal apps like Slack, GitHub, and CRM tools.
- **Collection:** Gathering customer PII, internal documentation, and technical configurations.
- **Exfiltration:** Manual and automated extraction of data from internal consoles.
- **Impact:** Unauthorized data access and reputational damage.
## Impact Assessment
- **Financial:** Significant costs associated with incident response, legal fees, and potential regulatory fines.
- **Data Breach:** Compromise of customer contact info, authentication logs, and internal corporate data.
- **Operational:** Disruption to internal IT services and necessity for organization-wide credential resets.
- **Reputational:** High-profile media coverage and loss of customer trust in cloud service providers.
## Indicators of Compromise
**Network Indicators (Defanged):**
- t-mobile-okta[.]com
- att-id[.]net
- vzwcorp[.]co
- mailchimp-okta[.]com
- okta-tmobiie[.]net
- 138[.]68[.]26[.]2
- 45[.]63[.]79[.]150
- 143[.]198[.]156[.]234
**Behavioral Indicators:**
- Logins to Okta from DigitalOcean, Vultr, or Linode IP ranges.
- Unusual timing for MFA requests or multiple failed MFA attempts followed by a success from a new device.
## Response Actions
- **Containment:** Blacklisting known phishing domains and blocking C2 IPs at the perimeter.
- **Eradication:** Terminating all active sessions for compromised users and resetting passwords/MFA seeds.
- **Recovery:** Restoring integrity to customer support tools and notifying affected third parties.
## Lessons Learned
- **2FA Vulnerability:** Standard SMS-based or TOTP-based 2FA is susceptible to real-time proxy/phishing attacks.
- **Supply Chain Risk:** Compromising a single service provider (like Twilio) can grant access to hundreds of downstream targets.
- **Employee Targeting:** Attackers are increasingly moving away from email to less-monitored channels like SMS.
## Recommendations
- **Hardware Keys:** Implement FIDO2-compliant hardware security keys (e.g., YubiKeys) to provide phishing-resistant authentication.
- **Mobile Security:** Deploy Mobile Threat Defense (MTD) solutions to detect and block malicious SMS links.
- **Monitoring:** Implement strict conditional access policies that restrict logins from unauthorized IP ranges or high-risk hosting providers.
- **Training:** Conduct specialized training for employees regarding "Smishing" and the risks of unsolicited text messages.