Full Report
Did you really lose your shipment on the way?
Analysis Summary
# Tool/Technique: Fake Shipment Tracking Phishing
## Overview
This technique involves a social engineering and phishing campaign designed to steal user credentials and financial information by impersonating logistics and postal services. The attack typically begins with a spoofed SMS or email notification regarding a "lost" or "undelivered" shipment, leveraging urgency to bypass victim scrutiny.
## Technical Details
- **Type**: Phishing / Social Engineering Technique
- **Platform**: Multi-platform (Web-based, targeting Mobile and Desktop users)
- **Capabilities**: Credential harvesting, financial data theft, SMS spoofing, malicious script execution.
- **First Seen**: Ongoing (Commonly exploited trend identified in recent Group-IB investigations).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- **TA0007 - Discovery**
- T1082 - System Information Discovery (via browser scripts)
- **TA0006 - Credential Access**
- T1557 - Adversary-in-the-Middle (via fake login portals)
- **TA0011 - Command and Control**
- T1102 - Web Service (Use of Telegram or phishing panels for data exfiltration)
## Functionality
### Core Capabilities
- **SMS Spoofing**: Sending messages that appear to originate from legitimate postal brands.
- **Phishing Infrastructure**: Hosting deceptive domains that replicate the UI/UX of official logistics websites.
- **Credential Harvesting**: Malicious scripts embedded in the phishing pages capture usernames, passwords, and two-factor authentication codes.
### Advanced Features
- **Urgency-Based Social Engineering**: Using lures such as "redelivery fees," "unpaid customs taxes," or "impending package return" to force immediate action.
- **Browser Fingerprinting**: Scripts may collect basic device information to tailor the phishing page for mobile vs. desktop views.
- **Data Monetization**: Stolen data is frequently automated for sale on Dark Web marketplaces or used for secondary fraud campaigns.
## Indicators of Compromise
- **File Hashes**: N/A (Web-based attack; primarily URL-driven)
- **File Names**: N/A
- **Registry Keys**: N/A
- **Network Indicators (Defanged)**:
- posties[.]icu
- estafmox[.]help
- nrcsnap[.]com
- pkgov[.]shop
- **Behavioral Indicators**:
- Sudden influx of SMS messages with shortened or suspicious URLs.
- Redirection from a logistics-themed landing page to an unofficial payment gateway.
## Associated Threat Actors
- Various cybercriminal groups and "scam-as-a-service" affiliates utilizing phishing kits.
## Detection Methods
- **Signature-based detection**: Monitoring for the presence of the specific phishing domains listed in the IOCs within web proxy or DNS logs.
- **Behavioral detection**: Identifying high volumes of SMS traffic containing keywords like "package," "shipment," or "delivery" originating from unauthorized SMS gateways.
- **URL Analysis**: Using automated tools to scan suspicious links for common phishing kit patterns or brand impersonation elements.
## Mitigation Strategies
- **Prevention**: Implement DMARC/SPF/DKIM for corporate domains and utilize SMS filtering services at the carrier or device level.
- **Hardening**: Enable Multi-Factor Authentication (MFA) that is resistant to phishing (e.g., FIDO2/WebAuthn).
- **User Education**: Train users to hover over links to verify destinations and to access logistics sites directly through official bookmarks or apps rather than SMS links.
## Related Tools/Techniques
- **Smishing (SMS Phishing)**: The primary delivery mechanism.
- **Phishing Kits**: Pre-packaged software used to deploy these fake tracking websites.
- **Typosquatting**: Registering domains similar to legitimate brands (e.g., "dhl-support" instead of "dhl.com").