Mysterious Global Phishing Campaign Uncovered



Angler_PhishingA mysterious phishing campaign was spotted by threat researchers from Anomali. The global credential gathering phishing campaign was directed primarily at government procurement departments; however, other sectors' including email and courier services were also targeted.

According to Anomali, "The elaborate scam used a legitimate compromised domain and various subdomains to create phishing pages designed for credential harvesting. Phishing emails went out in various languages."  The domains were hosted in Romania or Turkey and "all of the sites use Domain Validation (DV) certificates issued by “cPanel, Inc”.

The subdomains have similar naming conventions, targeting online credentials and containing a secure, verification, bidding or delivery theme", Anomali observed.  

Spoofed Organisations

  • United States - U.S. Department of Energy
  • United States - U.S. Department of Commerce
  • United States - U.S. Department of Veteran Affairs
  • United States - New Jersey House and Mortgage Finance Agency
  • United States - Maryland Government Procurement Services
  • United States - Florida Department of Managed Services
  • United States - Department of Transport
  • United States - Department of Housing and Urban Development
  • DHL International courier service
  • Canada -  Government eProcurement service
  • Mexico - Government eProcurement services
  • Peru - Public Procurement Centre
  • China - SF-Express courier service
  • China - Ministry of Transport
  • Japan - Ministry of Economy, Trade and Industry
  • Singapore - Ministry of Industry and Trade
  • Malaysia - Ministry of International Trade and Industry
  • Australia - Government eProcurement Portal
  • Sweden - Government Offices National Public Procurement Agency
  • Poland - Trade and Investment Agency
  • South Africa - Government Procurement Service

 Anomali’s  Conclusions:

"This credential harvesting campaign has been primarily targeting government bidding and procurement services. The focus on these services suggests the attacker is interested in those organisations (private and public) that may be a potential contractor or supplier for those governments targeted. The purpose of this insight could be a financial incentive to out compete a rival bidder, or more long term insight regarding the trust relationship between the potential supplier and the government in question.

Campaigns like these are difficult to protect against because unless the domains hosting the phishing pages are known as malicious, an organisations firewall will not know to block it.  Legitimate sites were also hosting the phishing pages, and were likely compromised as part of the campaign.

At the time of writing none of the sites in this campaign were active, Anomali researchers consider it likely that the actors will continue to target these services in the future." New-school security awareness training can help your employees recognize a scam when they see one. Read the very detailed Anomail report on their blog site.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Subscribe To Our Blog


Nuclear Ransomware Webinar




Get the latest about social engineering

Subscribe to CyberheistNews