Researchers at Menlo Security discovered three state-sponsored phishing campaigns that have targeted 40,000 important individuals over the past three months.
“In a recent 90-day period, Menlo Labs uncovered a trifecta of sophisticated [highly evasive and adaptive threat] campaigns—LegalQloud, Eqooqp, and Boomer—compromising at least 40,000 high-value users, including C-suite executives from major banking institutions, financial powerhouses, insurance giants, legal firms, government agencies, and healthcare providers, the researchers write.
“The breadth and depth of these breaches signal an alarming escalation in cyber warfare.” The first campaign, “LegalQloud,” is impersonating Microsoft to target government workers and investment bankers in North America.
“LegalQloud targets governments and investment banks in North America and impersonates the names of >500 legal firms and steals credentials,” Menlo Security writes. “The attack impersonates the Microsoft brand and is hosted on the Tencent Cloud (Tencent is the largest Internet company in China).
The associated domain is not blocked by URL categorization and related blocklist services. This threat is hosted globally and predominantly targets government entities in North America. LegalQloud targets investment banks as a second focus.”
The second campaign, called “Eqoop,” can bypass multifactor authentication and is targeting entities in the logistics, finance, petroleum, manufacturing, higher education, and research sectors. Menlo Security has detected nearly 50,000 attacks tied to this operation.
The third campaign, tracked as “Boomer,” uses a combination of sophisticated techniques throughout the attack chain. “Boomer targets government and healthcare sectors,” the researchers write. “The evasive techniques and software development tradecraft exceed previously identified campaigns.
Boomer will avoid detection if only traditional controls are in place. Boomer uses orchestrated, dynamic phishing sites, cookies, server-side logic, bot-detection countermeasures, encrypted code, and other techniques to
increase the attack's reach and stealth.”
Menlo Security has the story:
https://www.menlosecurity.com/press-releases/menlo-security-exposes-three-new-nation-state-campaigns
Here's how it works:
