According to Anomali, "The elaborate scam used a legitimate compromised domain and various subdomains to create phishing pages designed for credential harvesting. Phishing emails went out in various languages." The domains were hosted in Romania or Turkey and "all of the sites use Domain Validation (DV) certificates issued by “cPanel, Inc”.
The subdomains have similar naming conventions, targeting online credentials and containing a secure, verification, bidding or delivery theme", Anomali observed.
Spoofed Organisations
Anomali’s Conclusions:
"This credential harvesting campaign has been primarily targeting government bidding and procurement services. The focus on these services suggests the attacker is interested in those organisations (private and public) that may be a potential contractor or supplier for those governments targeted. The purpose of this insight could be a financial incentive to out compete a rival bidder, or more long term insight regarding the trust relationship between the potential supplier and the government in question.
Campaigns like these are difficult to protect against because unless the domains hosting the phishing pages are known as malicious, an organisations firewall will not know to block it. Legitimate sites were also hosting the phishing pages, and were likely compromised as part of the campaign.
At the time of writing none of the sites in this campaign were active, Anomali researchers consider it likely that the actors will continue to target these services in the future." New-school security awareness training can help your employees recognize a scam when they see one. Read the very detailed Anomail report on their blog site.