This breakdown of the latest attack from the Charming Kitten cybercriminal gang shows just how much thought goes into obfuscating their tactics and evading detection.
I’ve covered stories in the past where phishing attacks utilized well-known domains to keep from being detected, such as SharePoint Online, where the initial target site is credible enough to keep some security solutions from seeing the link as being malicious.
In the case of a recent attack by Cybercriminal group Charming Kitten (also known as APT35), the attack uses some pretty sophisticated tactics to avoid detection:
- The initial link send in text or email is a google.com link that points to a script.google.com address with some specific parameters including an identifier so the bad guys know it’s one of their redirects
- The script.google.com matches the included identifier and redirects the visitor to a predefined unique URL for that specific victim
- The third URL used is a redirection short URL. The really brilliant part is that initially, when used in conjunction with email-based phishing, the redirect points to a legitimate and benign webpage so that email scanners that traverse redirection will see it as legitimate. Once the email hits the Inbox, the redirect is changed to the malicious address
- Once the victim hits the final malicious address, a spoofed logon page is presented to attempt to steal the victim’s google credentials
- The user-specific malicious redirect is reconfigured back to a legitimate domain to hide the tracks of Charming Kitten
It’s evident that folks like Charming Kitten are putting a lot of effort and thought into avoiding detection before, during, and after the attack. This makes is nearly impossible for security solutions alone to protect users from such attacks. Users themselves need to be educated using Security Awareness Training to be watchful for unsolicited email and text messages – even when they appear to come from Google.
Here's how it works:
