Scary new details emerge of cybercriminals using reverse tunneling and URL shorteners to evade detection by security solutions, allowing them to take victims for their credentials and more.
We expect that as threat actors change their techniques, security solutions will keep up and detect attacks as they occur and before they can do any damage. But a new report from security vendor CloudSEK highlights a new campaign that allows the threat actors to host malicious webpages on their own local computers using a mix of reverse tunneling technology and URL shorteners.
According to the report, the use of reverse tunnel services allows threat actors to generate random URLs that avoid detection as being malicious, further obfuscating the URLs by running them through URL shorteners like Bit.ly, is.gd, and cutt.ly.
While these techniques aren’t necessarily new, the report does note that there is an increase in frequency and sophistication to these attacks, making them far more likely to be successful.
But in the end, the real success behind these phishing attacks – even those that use these advanced evasion techniques – is whether the recipient falls for the social engineering found in the email content and the malicious landing page hosted by the threat actor.
Users that are continually kept updated with Security Awareness Training are far more likely to see these scams for what they really are and far less likely to fall victim to such attacks.
This report makes it clear that threat actors are working to find ingenious ways to keep security solutions from detecting an attack, making it more imperative for organizations to empower users through continual training to play a role in stopping attacks.
