A new update on UNC3944 group's activities shows how they are evolving their focus squarely on SMiShing credential harvesting attacks that result in data theft/extortion attacks.
I somewhat tongue-in-cheek want to say “ransomware is SO yesterday” in that there is a trend we’re seeing where threat groups are no longer focusing of the encrypting of environments (as it tends to draw the attention of law enforcement more) and instead are placing their efforts on stealing data and extorting the victim organization.
One such uncategorized threat group – UNC3944 – appears to be following this trend. In a threat intelligence update by security vendor Mandiant, we learn how this group has changed tactics from SIM swapping attacks historically to using credential harvesting attacks via text message.
Using social engineering techniques that include impersonating single sign-on platforms and using phishing pages made to look like the target organization, UNC3944 has become rather successful at compromising credentials that they use to gain access to victim networks.
The activity is so sophisticated, that the threat actors have used the compromised credentials to gather details on the associated user and engaged the help desks at victim organizations:
After obtaining credentials, the threat actors have also impersonated employees on calls to victim organizations' service desks in an attempt to obtain multi-factor authentication (MFA) codes and/or password resets. During these calls, the threat actor provided verification information requested by the help desk employees, including usernames, employee IDs, and other types of personally identifiable information (PII) associated with employees.
What’s interesting is Mandiant’s suggested mitigations revolve solely around strengthening MFA and specific methods of detection for security solutions. What’s missing from their recommendations is to strengthen their user’s ability to spot these SMiShing attacks through continual security awareness training that helps them identify an attack before they provide credentials.
KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
New-school Security Awareness Training is critical to enabling you and your IT staff to connect with users and help them make the right security decisions all of the time. This isn't a one and done deal, continuous training and simulated phishing are both needed to mobilize users as your last line of defense. Request your one-on-one demo of KnowBe4's security awareness training and simulated phishing platform and see how easy it can be!
