Fangxiao: a Chinese threat actor

guest · Nov 17, 2022

Chinese Hackers Using 42,000 Imposter Domains in Massive Phishing Attack Campaign
By Ravie Lakshmanan - November 17, 2022

A China-based financially motivated group is leveraging the trust associated with popular international brands to orchestrate a large-scale phishing campaign dating back as far as 2019.
Click to expand...

The threat actor, dubbed Fangxiao by Cyjax, is said to have registered over 42,000 imposter domains, with initial activity observed in 2017.

"It targets businesses in multiple verticals including retail, banking, travel, and energy," researchers Emily Dennison and Alana Witten said. "Promised financial or physical incentives are used to trick victims into further spreading the campaign via WhatsApp."
Users clicking on a link sent through the messaging app are directed to an actor-controlled site, which, in turn, sends them to a landing domain impersonating a well-known brand, from where the victims are once again taken to sites distributing fraudulent apps and bogus rewards.
Click to expand...

"The operators are experienced in running these kinds of imposter campaigns, willing to be dynamic to achieve their objectives, and technically and logistically capable of scaling to expand their business," the researchers said.

"The Fangxiao campaigns are effective lead generation methods which have been redirected to various domains, from malware, to referral links, to ads and adware."
Click to expand...

Cyjax: Fangxiao: a Chinese threat actor

November 14, 2022
Phishing campaigns continue to increase globally. These operations offer an easy route for cybercriminals to generate revenue, steal credentials and spread malware.

Cyjax has recently investigated a sophisticated, large-scale phishing campaign that exploits the reputation of international, trusted brands, and targets businesses in multiple verticals including retail, banking, travel, pharmaceuticals, travel and energy.
Click to expand...

We are tracking the threat actors behind this campaign as Fangxiao, a group which we assess with high confidence to be based in China and motivated by profit. We have discovered over 42,000 unique Fangxiao-controlled domains used since 2019 and they continue to scale. The campaign operators deploy fairly typical lures: one particularly apposite example would be how they have sought to exploit anxieties about the COVID-19 pandemic.
Click to expand...

Log in or Sign up

Fangxiao: a Chinese threat actor

guest Guest

Log in or Sign up

Fangxiao: a Chinese threat actor

guest Guest

Useful Searches