Phishing: Целевой фишинг через сторонние сервисы
Other sub-techniques of Phishing (3)
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services. A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.
Примеры процедур |
|
| Название | Описание |
|---|---|
| Windshift |
Windshift has used fake personas on social media to engage and target victims.(Citation: SANS Windshift August 2018) |
| Ajax Security Team |
Ajax Security Team has used various social media channels to spearphish victims.(Citation: FireEye Operation Saffron Rose 2013) |
| EXOTIC LILY |
EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.(Citation: Google EXOTIC LILY March 2022) |
| Lazarus Group |
Lazarus Group has used fake job advertisements sent via LinkedIn to spearphish victims.(Citation: F-Secure Lazarus Cryptocurrency Aug 2020) |
| FIN6 |
FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.(Citation: Security Intelligence More Eggs Aug 2019) |
| APT29 |
APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails. (Citation: Cybersecurity Advisory SVR TTP May 2021) |
| OilRig |
OilRig has used LinkedIn to send spearphishing links.(Citation: FireEye APT34 July 2019) |
| Dark Caracal |
Dark Caracal spearphished victims via Facebook and Whatsapp.(Citation: Lookout Dark Caracal Jan 2018) |
| Lazarus Group |
Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.(Citation: Google TAG Lazarus Jan 2021)(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020) |
| Magic Hound |
Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.(Citation: SecureWorks Mia Ash July 2017)(Citation: Microsoft Phosphorus Mar 2019)(Citation: ClearSky Kittens Back 3 August 2020) |
Контрмеры |
|
| Контрмера | Описание |
|---|---|
| User Training |
Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction. |
| Antivirus/Antimalware |
Use signatures or heuristics to detect malicious software. |
| Restrict Web-Based Content |
Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. |
Обнаружение
Because most common third-party services used for spearphishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery. With SSL/TLS inspection intrusion detection signatures or other security gateway appliances may be able to detect malware. Anti-virus can potentially detect malicious documents and files that are downloaded on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe) for techniques such as Exploitation for Client Execution or usage of malicious scripts.
Ссылки
- F-Secure Labs. (2020, August 18). Lazarus Group Campaign Targeting the Cryptocurrency Vertical. Retrieved September 1, 2020.
- Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.
- Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.
- Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.
- ClearSky Research Team. (2020, August 1). The Kittens Are Back in Town 3 - Charming Kitten Campaign Evolved and Deploying Spear-Phishing link by WhatsApp. Retrieved April 21, 2021.
- Burt, T. (2019, March 27). New steps to protect customers from hacking. Retrieved May 27, 2020.
- Counter Threat Unit Research Team. (2017, July 27). The Curious Case of Mia Ash: Fake Persona Lures Middle Eastern Targets. Retrieved February 26, 2018.
- Karim, T. (2018, August). TRAILS OF WINDSHIFT. Retrieved June 25, 2020.
- Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
- Villeneuve, N. et al.. (2013). OPERATION SAFFRON ROSE . Retrieved May 28, 2020.
- NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.
- Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021.
- ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
- Weidemann, A. (2021, January 25). New campaign targeting security researchers. Retrieved December 20, 2021.
Связанные риски
| Риск | Связи | |
|---|---|---|
|
Боковое перемещение злоумышленника по локальной сети из-за
реагирования на мошеннические, фишинговые письма и сообщения у работника
Конфиденциальность
Целостность
|
|
|
|
Заражение вредоносным программным обеспечением из-за
реагирования на мошеннические, фишинговые письма и сообщения у работника
Доступность
Конфиденциальность
Отказ в обслуживании
Повышение привилегий
Раскрытие информации
Целостность
Искажение
|
2
|
|
|
Раскрытие информации об ИТ инфраструктуре из-за
реагирования на мошеннические, фишинговые письма и сообщения у работника
Конфиденциальность
Раскрытие информации
|
|
|
|
Раскрытие ключей (паролей) доступа из-за
реагирования на мошеннические, фишинговые письма и сообщения у работника
Конфиденциальность
Повышение привилегий
Раскрытие информации
Подмена пользователя
|
1
|
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.