Researchers Warns of Large-Scale AiTM Attacks Targeting Enterprise Users

guest · Aug 3, 2022

August 3, 2022

A new, large-scale phishing campaign has been observed using adversary-in-the-middle (AitM) techniques to get around security protections and compromise enterprise email accounts.

"It uses an adversary-in-the-middle (AitM) attack technique capable of bypassing multi-factor authentication," Zscaler researchers Sudeep Singh and Jagadeeswar Ramanukolanu said in a Tuesday report. "The campaign is specifically designed to reach end users in enterprises that use Microsoft's email services."
Click to expand...

Prominent targets include fintech, lending, insurance, energy, manufacturing, and federal credit union verticals located in the U.S., U.K., New Zealand, and Australia.

This is not the first time such a phishing attack has come to light. Last month, Microsoft disclosed that over 10,000 organizations had been targeted since September 2021 by means of AitM techniques to breach accounts secured with multi-factor authentication (MFA).
Click to expand...

Zscaler said it observed the attacker manually logging into the account eight minutes after the credential theft, following it up by reading emails and checking the user's profile information.

What's more, in some instances, the hacked email inboxes are subsequently used to send additional phishing emails as part of the same campaign to conduct business email compromise (BEC) scams.

"With the use of advanced phishing kits (AiTM) and clever evasion techniques, threat actors can bypass both traditional as well as advanced security solutions."
Click to expand...

Zscaler: Large-Scale AiTM Attack targeting enterprise users of Microsoft email services

ThreatLabz has discovered a new strain of a large-scale phishing campaign, which uses adversary-in-the-middle (AiTM) techniques along with several evasion tactics. Similar AiTM phishing techniques were used in another phishing campaign described by Microsoft recently here.

This campaign stands out from other commonly seen phishing attacks in several ways. It uses an adversary-in-the-middle (AiTM) attack technique capable of bypassing multi-factor authentication. There are multiple evasion techniques used in various stages of the attack designed to bypass conventional email security and network security solutions.

In this blog, we describe details of the tactics, techniques and procedures (TTPs) involved in the campaign.
Click to expand...

Key points

Corporate users of Microsoft's email services are the main targets of this large-scale phishing campaign.

All these phishing attacks begin with an email sent to the victim with a malicious link.

The campaign is active at the time of blog publication and new phishing domains are registered almost every day by the threat actor.

In some cases, the business emails of executives were compromised using this phishing attack and later used to send further phishing emails as part of the same campaign.

Some of the key industry verticals such as FinTech, Lending, Insurance, Energy and Manufacturing in geographical regions such as the US, UK, New Zealand and Australia are targeted.

Click to expand...

A custom proxy-based phishing kit capable of bypassing multi-factor authentication (MFA) is used in these attacks.

Various cloaking and browser fingerprinting techniques are leveraged by the threat actor to bypass automated URL analysis systems.

Numerous URL redirection methods are used to evade corporate email URL analysis solutions.

Legitimate online code editing services such as CodeSandbox and Glitch are abused to increase the shelf life of the campaign.

Click to expand...

guest · Aug 24, 2022

Researchers Warn of AiTM Attack Targeting Google G-Suite Enterprise Users
August 24, 2022

The threat actors behind a large-scale adversary-in-the-middle (AiTM) phishing campaign targeting enterprise users of Microsoft email services have also set their sights on Google Workspace users.

"This campaign specifically targeted chief executives and other senior members of various organizations which use [Google Workspace]," Zscaler researchers Sudeep Singh and Jagadeeswar Ramanukolanu detailed in a report published this month.
The AitM phishing attacks are said to have commenced in mid-July 2022, following a similar modus operandi as that of a social engineering campaign designed to siphon users' Microsoft credentials and even bypass multi-factor authentication.

The low-volume Gmail AiTM phishing campaign also entails using the compromised emails of chief executives to conduct further phishing attacks by the threat actor, with the attacks also utilizing several compromised domains as an intermediate URL redirector to take the victims to the landing page.
Click to expand...

Attack chains involve sending password expiry emails to potential targets that contain an embedded malicious link to supposedly "extend your access," tapping which takes the recipient to open redirect pages of Google Ads and Snapchat to load the phishing page URL.

Beside open redirect abuse, a second variant of the attacks relies on infected sites which host a Base64-encoded version of the next-stage redirector and the victim's email address in the URL. This intermediate redirector is a JavaScript code that points to a Gmail phishing page.
Click to expand...

Zscaler: AiTM phishing attack targeting enterprise users of Gmail

Key Points
• Beginning in July 2022, the same threat actor that used AiTM phishing kits to target enterprise users of Microsoft email services began targeting enterprise users of G Suite.
• The attack is capable of bypassing multi-factor authentication (MFA) protection of Gmail.
• These phishing emails were sent to chief executives and other senior members of the targeted organizations in the US. In some cases, the emails were also sent to the executive assistants of the CEOs and CFOs.
• The compromised emails of chief executives were used to conduct further phishing attacks by the threat actor.
• Multiple compromised domains were used as an intermediate URL redirector to land the user on the final phishing page.
• A similar client-side fingerprinting script was used for evasion by the threat actor as observed in the previous campaign.
• The same redirector scripts used in the Microsoft phishing campaign were updated to target G Suite enterprise users.
Click to expand...

guest · Sep 3, 2022

Hackers use AiTM attack to monitor Microsoft 365 accounts for BEC scams
By Bill Toulas @billtoulas - August 24, 2022

A new business email compromise (BEC) campaign has been discovered combining sophisticated spear-phishing with Adversary-in-The-Middle (AiTM) tactics to hack corporate executives' Microsoft 365 accounts, even those protected by MFA.

Researchers at Mitiga discovered the new campaign during an incident response case and report it's widespread now, targeting transactions of up to several million USD each.
Click to expand...

From compromise to MFA persistence
The attack on the company executives begins with a phishing email made to appear as if it originates from DocuSign, an electronic agreements management platform used extensively in corporate environments.

The threat actors are believed to be using a phishing framework, such as the evilginx2 proxy, to conduct what is called an Adversary-in-the-Middle (AiTM) attack.
During AiTM attacks, tools like evilginx2 act as proxies that sit in the middle between a phishing page and a legitimate login form for a targeted company.
Click to expand...

As the proxy sits in the middle, when a victim enters their credentials and solves the MFA question, the proxy steals the session cookie generated by the Windows domain.
The threat actors can now load the stolen session cookies into their own browsers to automatically log into the victim's account and bypass MFA, which had been verified in the previous login.

In the case seen by Mitiga, the threat actor added a mobile phone as the new authentication device, ensuring their uninterrupted access to the compromised account.
Click to expand...

Mitiga: Advisory: Persistent MFA Circumvention in an Advanced BEC Campaign on Microsoft 365 Targets

Mitiga spotted a sophisticated, advanced business email compromise campaign, targeting Microsoft 365 organizations, leveraging inherent weaknesses in Microsoft 365 MFA, Microsoft Authenticator, and Microsoft 365 Identity Protection.

These weaknesses effectively nullify the added security allegedly provided by multi-factor authentication (MFA), allowing for full compromise, even of accounts that have enabled MFA.
Click to expand...

Log in or Sign up

Researchers Warns of Large-Scale AiTM Attacks Targeting Enterprise Users

guest Guest

guest Guest

guest Guest

Log in or Sign up

Researchers Warns of Large-Scale AiTM Attacks Targeting Enterprise Users

guest Guest

guest Guest

guest Guest

Useful Searches