An ongoing large-scale phishing campaign targets European businesses and attempts to obtain credentials for their Microsoft Azure cloud infrastructure. While businesses in multiple sectors have been attacked, the majority are in the automotive, chemical, and industrial manufacturing sectors. According to an analysis of the campaign by the Unit 42 team, this campaign has targeted at least 20,000 businesses in Europe.
Like many current phishing campaigns targeting companies, the campaign uses DocuSign-themed lures, where the user is asked to review an emailed document, which includes the branding of the company being targeted. If the document is opened, the user is directed via embedded hyperlinks to an online form created using HubSpot’s free online form builder tool. The drag-and-drop form builder allows forms to be created quickly, and in this case, the threat actor has used the free-to-use tool to create a form with a link button to view the document on Microsoft’s secured cloud.
If the button is clicked, the user will be directed to a phishing page that mimics the Office 365 Outlook Web App login page. If credentials are entered in the fake login page – commonly hosted on attacker-controlled .buzz domains – they are captured by the threat actor, who will attempt to login, and then pivot and move laterally to the cloud. A successful login will see the threat actor add a new device to the victim’s account for persistence.
There are several measures that can be taken by businesses to protect against phishing campaigns such as this, starting with an email spam filter to block the initial contact via email. SpamTitan is an advanced cloud-based anti-spam service for blocking email phishing and malware threats. The solution checks inbound messages against up-to-the-minute lists of blacklisted domains, performs SPF, DKIM, and DMARC checks, malware scans, assessments of message headers and content for phishing indicators, and incorporates AI and machine learning algorithms to identify anomalies in message content. Email sandboxing is used to subject messages to in-depth analysis to identify zero day threats. In recent independent testing by VirusBulletin, SpamTitan achieved first place for overall score out of 11 leading email security solutions, blocking 100% of phishing attempts, 100% of malware, and 99.998% of spam email, with a 0.00% false positive rate.
Security awareness training is vital to teach security best practices and make employees aware of threats, including email threats that abuse legitimate services and tools. TitanHQ’s SafeTitan platform allows businesses to quickly create and automate security awareness training programs, tailored for departments, user groups, and individuals, and reinforce training through phishing simulations. An additional recommended protection is the WebTitan DNS-based web filter, which incorporates URL filtering to prevent users from visiting known malicious websites, incorporating controls to prevent users from downloading malware.
For more information on improving your defenses against phishing, give the TitanHQ team a call today. The full TitanHQ suite of cybersecurity solutions is available on a free trial, with full product support provided throughout the trial.