State-Sponsored Phishing Campaigns Target 40,000 VIP Individuals

40000Researchers at Menlo Security discovered three state-sponsored phishing campaigns that have targeted 40,000 important individuals over the past three months.

“In a recent 90-day period, Menlo Labs uncovered a trifecta of sophisticated [highly evasive and adaptive threat] campaigns—LegalQloud, Eqooqp, and Boomer—compromising at least 40,000 high-value users, including C-suite executives from major banking institutions, financial powerhouses, insurance giants, legal firms, government agencies, and healthcare providers, the researchers write. 

“The breadth and depth of these breaches signal an alarming escalation in cyber warfare.” The first campaign, “LegalQloud,” is impersonating Microsoft to target government workers and investment bankers in North America.

“LegalQloud targets governments and investment banks in North America and impersonates the names of >500 legal firms and steals credentials,” Menlo Security writes. “The attack impersonates the Microsoft brand and is hosted on the Tencent Cloud (Tencent is the largest Internet company in China). 

The associated domain is not blocked by URL categorization and related blocklist services. This threat is hosted globally and predominantly targets government entities in North America. LegalQloud targets investment banks as a second focus.”

The second campaign, called “Eqoop,” can bypass multifactor authentication and is targeting entities in the logistics, finance, petroleum, manufacturing, higher education, and research sectors. Menlo Security has detected nearly 50,000 attacks tied to this operation.

The third campaign, tracked as “Boomer,” uses a combination of sophisticated techniques throughout the attack chain. “Boomer targets government and healthcare sectors,” the researchers write. “The evasive techniques and software development tradecraft exceed previously identified campaigns. 

Boomer will avoid detection if only traditional controls are in place. Boomer uses orchestrated, dynamic phishing sites, cookies, server-side logic, bot-detection countermeasures, encrypted code, and other techniques to 
increase the attack's reach and stealth.”

Menlo Security has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews