A mysterious phishing campaign was spotted by threat researchers from Anomali. The global credential gathering phishing campaign was directed primarily at government procurement departments; however, other sectors' including email and courier services were also targeted.
According to Anomali, "The elaborate scam used a legitimate compromised domain and various subdomains to create phishing pages designed for credential harvesting. Phishing emails went out in various languages." The domains were hosted in Romania or Turkey and "all of the sites use Domain Validation (DV) certificates issued by “cPanel, Inc”.
The subdomains have similar naming conventions, targeting online credentials and containing a secure, verification, bidding or delivery theme", Anomali observed.
Spoofed Organisations
- United States - U.S. Department of Energy
- United States - U.S. Department of Commerce
- United States - U.S. Department of Veteran Affairs
- United States - New Jersey House and Mortgage Finance Agency
- United States - Maryland Government Procurement Services
- United States - Florida Department of Managed Services
- United States - Department of Transport
- United States - Department of Housing and Urban Development
- DHL International courier service
- Canada - Government eProcurement service
- Mexico - Government eProcurement services
- Peru - Public Procurement Centre
- China - SF-Express courier service
- China - Ministry of Transport
- Japan - Ministry of Economy, Trade and Industry
- Singapore - Ministry of Industry and Trade
- Malaysia - Ministry of International Trade and Industry
- Australia - Government eProcurement Portal
- Sweden - Government Offices National Public Procurement Agency
- Poland - Trade and Investment Agency
- South Africa - Government Procurement Service
Anomali’s Conclusions:
"This credential harvesting campaign has been primarily targeting government bidding and procurement services. The focus on these services suggests the attacker is interested in those organisations (private and public) that may be a potential contractor or supplier for those governments targeted. The purpose of this insight could be a financial incentive to out compete a rival bidder, or more long term insight regarding the trust relationship between the potential supplier and the government in question.
Campaigns like these are difficult to protect against because unless the domains hosting the phishing pages are known as malicious, an organisations firewall will not know to block it. Legitimate sites were also hosting the phishing pages, and were likely compromised as part of the campaign.
At the time of writing none of the sites in this campaign were active, Anomali researchers consider it likely that the actors will continue to target these services in the future." New-school security awareness training can help your employees recognize a scam when they see one. Read the very detailed Anomail report on their blog site.
