One Article Review
| Source |  AlienVault Lab Blog |
|---|---|
| Identifiant | 8554209 |
| Date de publication | 2024-08-08 18:00:00 (vue: 2024-08-08 18:17:18) |
| Titre | Histoires du Soc - Semer les graines de la cybercriminalité: The Credential Harvester Stories from the SOC - Sowing the Seeds of Cybercrime: The Credential Harvester |
| Texte | Executive Summary
Cyber attackers are constantly innovating new ways to compromise users and steal credentials. Among these techniques, credential harvesting through phishing attempts is one of the most prevalent methods. This deceptive strategy often involves attackers creating a fake site that mirrors a legitimate login page. They distribute links to this phony site through sophisticated phishing emails, embedding redirect links that appear trustworthy through open-source intelligence (OSINT) but direct unsuspecting users to their trap.
Recently, the LevelBlue managed detection and response (MDR) security operations center (SOC) team responded to an alarm regarding a user clicking on a malicious link in a phishing email. The analyst recognized the threat as credential harvesting and quickly provided the customer with mitigation steps, helping to prevent further damage to the user and the organization.
Investigation
Initial Alarm Review
Indicators of Compromise (IOC)
To effectively respond to and investigate credential harvesting threats, it is crucial to recognize their signs:
Mismatched URL: The displayed URL in the email or browser might not match the URL of the legitimate site it purports to be.
Unusual page elements: Differences in formatting, language, or user interface compared to the genuine login page
Suspicious redirects: The path taken by a link through multiple websites or unusually long URLs
CAPTCHA tests: Often used on fake pages to make them appear more legitimate
Figure 1: Initial alarm with username and URL visited
In this case, the alarm shows that an email was sent with the subject line “[External] Document ready, Review and Sign Today Thursday-March-2024 19:20 PM.” This is a common format attackers use in phishing emails use to trick users into thinking there is a legitimate document that needs to be signed.
The screenshot shows the full URL contained in the email. When the analyst submitted the first domain in the URL (\'www.samsonstonesc[.]com\') through OSINT sites, it returned a clean reputation, which would indicate that this is a verified website; however, deeper in this link is \'ahmetorak[.]com,\' and when this domain was submitted to various OSINT sites, it returned a malicious reputation.
Expanded Investigation
Events Search
Once the URL was identified as suspicious, the analyst performed the following:
Deep link analysis: They investigated where the link led to as well as the reputation of each redirect or proxy domain involved
Sandbox analysis: They copied the URL into a secure, isolated environment so its behavior could be observed without risk.
Verify page authenticity: They checked for discrepancies in the fake page’s content and reviewed SSL certificates, and domain registration details against the expected values.
The analyst observed that the URL was redirected to a CAPTCHA screen, which once completed directed the analyst to a website masquerading as a Microsoft login page being used for a credential harvester.
The below screenshot of this login page provides clear indicators that it is not a legitimate Microsoft login page and is in fact a credential harvester:
The URL at the top of the page does not match that of an actual Microsoft page.
Scrolling over “Forgot My Password” shows a link leading back to the fraudulent page.
Figure 2: Fake Microsoft login screen of the credential harvester
These websites are often hosted on an attacker’s server as a proxy. Once the user inputs their credentials, the attacker will receive this data and forward the user to a legitimate page. This makes it even mo |
| Notes | ★★ |
| Envoyé | Oui |
| Condensat | “forgot 19:20 2024 access account accounts actions active activity actor actual added additional address affected after against ahmetorak alarm alerted allowed also among analysis: analyst analyst’s any appear are attacker attacker’s attackers attempted attempts authentication authenticity: back been before began behavior behaviors being below breaches browser building but can captcha case caused center certificates checked chinese clean clear clicked clicking com common compared completed compromise compromised conclusion constantly contained content copied could creating credential credentials crucial customer cyber cybercrime: damage data deceptive deep deeper detailed details detection did differences difficult diligence direct directed discovery discrepancies displayed distribute document does domain due each educate effectively elements: eliminate email emails embedding enforce enhance environment even events evidence executive expanded expected external fact factor fake figure first following: foreign format formatting forward fraudulent from full further future gaining genuine had harvester harvester: harvesting have having helping highlights hosted however identified implementing importance incident included: increasingly indicate indicators infer information initial innovating input inputs intelligence interface investigate investigated investigation involved involves ioc isolated its just language leading led legitimate levelblue likelihood likely line link links locking log login long make makes malicious managed march masquerading match mdr measures methods mfa microsoft might mirrors mismatched mitigate mitigation more most multi multiple need needs new not observed observing often once one open operations organization organizations osint over page page’s pages password password” path perform performed phishing phony place prevalent prevent protect provided provides proxy purports quickly rapid ready receive received recently recognize recognized recommended redirect redirected redirects: reduce regarding registration relayed reputation resetting respond responded response returned revealed review reviewed revoking risk robust samsonstonesc sandbox screen screenshot scrolling search secure security seeds sent server sessions should shown shows sign signed signs signs: site sites soc sophisticated source sowing ssl steal steps stolen stories strategy strong subject submitted succeed successful such summary suspicious taken team techniques tests: them these thinking threat threats through thursday today top traffic trap trick trustworthy unauthorized understand unsuspecting unusual unusually url url: urls use used user user’s username users using values various verified verify visited ways website website; websites well when where which will without would www |
| Tags | Threat |
| Stories | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.