Full Report
Explore the advanced tactics employed in recent email phishing campaigns targeting employees from over 30 companies across 12 industries and 15 jurisdictions. This blog unveils sophisticated techniques used to outsmart Secure Email Gateways (SEGs) and exploit trusted platforms, creating highly convincing schemes to deceive victims and steal their credentials.
Analysis Summary
# Tool/Technique: Advanced SEG-Evasion Phishing (Trusted Platform Exploitation)
## Overview
This technique involves a sophisticated email phishing campaign designed to bypass Secure Email Gateways (SEGs) by exploiting the reputation of trusted platforms (such as cloud services, document sharing sites, and legitimate business tools). The primary goal is to deceive employees across multiple industries into providing corporate credentials through highly convincing, multi-staged redirection schemes.
## Technical Details
- **Type:** Technique (Phishing & Credential Theft)
- **Platform:** Web-based (cross-platform), targeting corporate email users.
- **Capabilities:** SEG evasion, multi-stage redirection, brand impersonation, and automated credential harvesting.
- **First Seen:** Recent campaigns (Q3-Q4 2023 / 2024 timeframe).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0007 - Discovery]**
- [T1589.002 - Gather Victim Identity Information: Email Addresses]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1641 - User Execution]
## Functionality
### Core Capabilities
- **Trusted Platform Abuse:** Leverages legitimate domains (e.g., Google, Microsoft, Dropbox) to host redirectors or initial phishing lures, ensuring the email bypasses standard reputation-based filters.
- **Credential Harvesting:** Deploys pixel-perfect replicas of corporate login pages (Office 365, Okta, etc.) to steal usernames, passwords, and potentially MFA tokens.
- **Industry Targeting:** Highly tailored lures specific to 12 industries, including finance, manufacturing, and technology.
### Advanced Features
- **SEG Evasion:** Uses "Living off Trusted Sites" (LoTS) tactics, such as embedding malicious URLs within legitimate PDF attachments or using QR codes to move the attack off-platform.
- **Geofencing/Targeting:** Scripts that check the visitor's IP or jurisdiction to ensure the phishing page only loads for intended targets, evading automated sandbox analysis.
- **Obfuscation:** Encrypted JavaScript or HTML smuggling to hide the intent of the phishing page from endpoint security tools.
## Indicators of Compromise
*Note: Indicators are based on typical patterns identified in these campaigns.*
- **File Names:** `Invoice_Order.pdf`, `Salary_Adjustment.pdf`, `Security_Update.html`
- **Network Indicators (Defanged):**
- `hxxps[://]legit-platform[.]com/share/malicious-redirect`
- `hxxps[://]storage[.]googleapis[.]com/ident-verif-check/[unique-id]`
- `hxxp[://]corporate-login-verify[.]net`
- `hxxps[://]pub-web-hosting[.]site/auth/login.php`
- **Behavioral Indicators:**
- Unexpected outbound connections from email clients to cloud storage providers.
- User navigation to top-level domains (TLDs) like `.top`, `.xyz`, or `.icu` following a link click in an email.
## Associated Threat Actors
- **Groups:** While specific attribution is often difficult, these tactics are commonly associated with **Business Email Compromise (BEC)** syndicates and financial motivated actors (e.g., potential overlap with **TA577** or **UNC2633**).
## Detection Methods
- **Behavioral Detection:** Monitoring for "Look-alike" domains or unauthorized use of corporate branding on external assets.
- **SEG Configuration:** Enabling "Time-of-Click" protection and deep scan analysis for cloud-hosted links.
- **YARA Rules:**
- Detect HTML smuggling patterns (e.g., `window.atob` or `Blob` objects used for file creation).
- Detect specific strings associated with credential harvesting kits (e.g., "login_submit", "password_field").
## Mitigation Strategies
- **Prevention Measures:** Implement **FIDO2-compliant Multi-Factor Authentication (MFA)** to prevent bypass via AitM (Adversary-in-the-Middle) proxies.
- **Hardening:** Use DMARC (Reject policy), SPF, and DKIM to prevent domain spoofing.
- **User Training:** Conduct specific training on recognizing "Living off Trusted Sites" (LoTS) attacks and the dangers of clicking links within trusted cloud documents.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AitM) Phishing:** Used to bypass 2FA in real-time.
- **HTML Smuggling:** Technique to deliver malicious payloads past network filters.
- **QR Code Phishing (Quishing):** Moving the attack to a mobile device to bypass desktop security controls.