Microsoft describes a sophisticated phishing campaign that targeted several financial organizations.
“Microsoft Defender Experts uncovered a multi-stage adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) attack against banking and financial services organizations,” the researchers write. “The attack originated from a compromised trusted vendor and transitioned into a series of AiTM attacks and follow-on BEC activity spanning multiple organizations. This attack shows the complexity of AiTM and BEC threats, which abuse trusted relationships between vendors, suppliers, and other partner organizations with the intent of financial fraud.”
The attackers used indirect proxies in order to create targeted phishing pages.
“While the attack achieved the end goal of a typical AiTM phishing attack followed by business email compromise, notable aspects, such as the use of indirect proxy rather than the typical reverse proxy techniques, exemplify the continuous evolution of these threats,” the researchers write. “The use of indirect proxy in this campaign provided attackers control and flexibility in tailoring the phishing pages to their targets and further their goal of session cookie theft. After signing in with the stolen cookie through a session replay attack, the threat actors leveraged multifactor authentication (MFA) policies that have not been configured using security best practices in order to update MFA methods without an MFA challenge. A second-stage phishing campaign followed, with more than 16,000 emails sent to the target’s contacts.”
After compromising the initial account, the threat actors used the access to launch targeted attacks against the people who had recently communicated with the victim.
“The emails were sent to the compromised user’s contacts, both within and outside of the organization, as well as distribution lists,” the researchers write. “The recipients were identified based on the recent email threads in the compromised user’s inbox. The subject of the emails contained a unique seven-digit code, possibly a tactic by the attacker to keep track of the organizations and email chains.”
New-school security awareness training can give your organization an essential layer of defense by enabling your employees to thwart BEC attacks.
Microsoft has the story.
Here's how it works:
