Full Report
Blowing the lid off of interesting adversary-in-the-middle tradecraft observed in the Huntress partner identities.
Analysis Summary
# Tool/Technique: Smuggler’s Gambit (HTML Smuggling + AiTM)
## Overview
This technique is a sophisticated phishing tradecraft that combines **HTML Smuggling** with **Adversary-in-the-Middle (AiTM)** session theft. The attacker delivers an HTML file that, when opened, dynamically renders a transparently proxied login portal (e.g., Microsoft Outlook) within a locally rendered iframe. This allows the attacker to bypass Multi-Factor Authentication (MFA) by stealing session cookies in real-time.
## Technical Details
- **Type**: Technique / Attack Chain
- **Platform**: Web browsers (Targeting Microsoft 365/Outlook users)
- **Capabilities**: HTML Smuggling, Credential Harvesting, MFA Bypass, Session Token Theft, Transparent Proxying.
- **First Seen**: Identified by Huntress on May 21, 2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- T1059.007 - Command and Scripting Interpreter: JavaScript
- **TA0005 - Defense Evasion**
- T1027.006 - Obfuscated Files or Information: HTML Smuggling
- **TA0006 - Credential Access**
- T1557 - Adversary-in-the-Middle
- T1111 - Two-Factor Authentication Evasion
## Functionality
### Core Capabilities
- **HTML Smuggling**: Uses `document.write()` and Base64 encoded blobs to reconstruct and render malicious content locally in the browser, bypassing traditional email gateway filters that look for suspicious attachments.
- **Credential Harvesting**: Serves a pixel-perfect replica of the Outlook/Microsoft login page to deceive users into entering their credentials.
### Advanced Features
- **Transparent Proxy via Iframe**: Unlike traditional phishing that redirects to a static fake site, this technique renders a proxied version of the actual login portal inside an iframe.
- **MFA Bypass**: By acting as a transparent proxy, the attacker intercepts the authentication flow, including the MFA challenge. If the user completes the MFA, the attacker captures the successful session cookie (Token Theft).
- **Automated Infrastructure**: The use of specific subdomain patterns (`rnsnno.[domain].pro`) across multiple recently registered domains suggests an automated or templated deployment.
## Indicators of Compromise
- **File Hashes**:
- SHA256: `18470571777CA2628747C4F39C8DA39CA81D1686820B3927160560455A603E49` (HTML Smuggling Payload)
- **Network Indicators**:
- `rnsnno.szyby[.]pro`
- `rnsnno.kycmaxcapital[.]pro`
- `rnsnno.2398-ns[.]pro`
- `b-o-a[.]xyz` (Associated Phishing)
- **Behavioral Indicators**:
- Unexpected local HTML files opening a browser and immediately displaying a login prompt.
- Browser network traffic reaching out to newly registered `.pro` domains for authentication resources.
## Associated Threat Actors
- **Unknown**: While the specific group is not named, the infrastructure uses NameCheap and suggests a mass phishing campaign operator.
## Detection Methods
- **Behavioral Detection**:
- Monitor for the execution of `document.write()` or `Blob()` functions within HTML attachments to reconstruct content.
- Detect unauthorized iframes attempting to load authentication endpoints from non-standard domains.
- **Identity Monitoring**:
- Use Identity Threat Detection and Response (ITDR) to flag logins originating from known transparent proxy infrastructure.
- Audit for session tokens generated from suspicious IP addresses or mismatched User-Agents.
## Mitigation Strategies
- **Technical Controls**:
- Implement **FIDO2-based MFA** (Security Keys or Windows Hello), which is resistant to AiTM/proxy attacks because the hardware key validates the domain origin.
- Block or restrict the opening of `.html` or `.htm` attachments directly from email clients.
- **Hardening**:
- Use Conditional Access policies to restrict logins to compliant or hybrid-joined devices.
- Implement DNS filtering to block newly registered domains (NRDs).
## Related Tools/Techniques
- **Evilginx2 / Muraena**: Known frameworks for performing automated AiTM attacks.
- **SocGholish**: Another prominent threat using HTML Smuggling for initial access.
- **Session Cookie Theft**: The primary goal of modern AiTM tradecraft.