Threat groups are adopting 'BazarCall' (BazaCall) Phishing Attacks as an Initial Attack Vector

guest · Aug 12, 2022

BazarCall attacks have revolutionized ransomware operations
August 12, 2022

The Conti ransomware gang is using BazarCall phishing attacks as an initial attack vector to access targeted networks.

BazarCall attack, aka call back phishing, is an attack vector that utilizes targeted phishing methodology and was first used by the Ryuk ransomware gang in 2020/2021.
Click to expand...

The BazarCall attack chain is composed of the following stages:

Stage One. Attackers send a mail to the victims that notify them that they have subscribed to a service for which payment is automatic. The email includes a phone number to call to cancel the subscription.

Stage Two. The victim is tricked into contacting a special call center. When operators receive a call, they use a variety of social engineering tactics, to convince victims to give remote desktop control, to help them cancel their subscription service.

Stage Three. Once accessed the victim’s desktop, the attacker silently extended a foothold in the user’s network, weaponizing legitimate tools that are known to be in Conti’s arsenal. The initial operator remains on the line with the victim, pretending to assist them with the remote desktop access by continuing to utilize social engineering tactics.

Stage Four. The initiated malware session yields the adversary access as an initial point of entry into the victim’s network.

Click to expand...

The researchers at cybersecurity firm AdbIntel state that currently at least three autonomous threat groups are adopting and independently developing their own targeted phishing tactics derived from the call back phishing methodology. The three groups are tracked as Silent Ransom, Quantum, and Roy/Zeon, they emerged after the Conti gang opted to shut down its operation in May 2022.

The adoption of Callback phishing campaigns has impacted the strategy of ransomware gangs, experts observed targeted attacks aimed at Finance, Technology, Legal, and Insurance industries.

“Since its resurgence in March earlier this year, call back phishing has entirely revolutionized the current threat landscape and forced its threat actors to reevaluate and update their methodologies of attack in order to stay on top of the new ransomware food chain.” concludes the report published by Advintel.
Click to expand...

Advintel: “BazarCall” Advisory: Essential Guide to Attack Vector that Revolutionized Data Breaches

“BazarCall” style attack, or call back phishing, is an attack vector that utilizes targeted phishing methodology and that first emerged in 2020/2021 as a tool of Ryuk (later rebranded Conti).

The tool has proven useful and malleable enough to fit an entire lineage of criminal hands. Callback phishing tactics have widely proliferated, completely changing the current threat landscape.
Click to expand...

BazarCall is notable for reversing the dynamic of a typical phishing operation with an advanced understanding of social engineering and targeted phishing (otherwise known as Spearphishing) and for quickly improving and adapting its operational tactics after only a three-month period.
Click to expand...

guest · Aug 15, 2022

Callback phishing attacks see massive 625% growth since Q1 2021
August 15, 2022

Hackers are increasingly moving towards hybrid forms of phishing attacks that combine email and voice social engineering calls as a way to breach corporate networks for ransomware and data extortion attacks.

According to Agari's Q2 2022 cyber-intelligence report, phishing volumes have only increased by 6% compared to Q1 2022. However, the use of 'hybrid vishing' is seeing a massive 625% growth.
Click to expand...

Vishing, "voice phishing," involves some form of a phone call to perform social engineering on the victim.

Its hybrid form, called "callback phishing," also includes an email before the call, typically presenting the victim with a fake subscription/invoice notice.
The recipient is advised to call on the provided phone number to resolve any issues with the charge, but instead of a real customer support agent, the call is answered by phishing actors.
Click to expand...

The attacks work so well that multiple ransomware and extortion gangs, such as Quantum, Zeon, and Silent Ransom Group, have adopted the same technique today to gain initial network access through an unsuspecting employee.

"Hybrid Vishing attacks reached a six-quarter high in Q2, increasing 625% from Q1 2021. This threat type also contributed to 24.6% of the overall share of Response-Based threats," details the Agari report.
Click to expand...

guest · Nov 22, 2022

Luna Moth's Novel, Malware-Free Extortion Campaign Takes Flight
By Jai Vijayan @jaivijayan - November 21, 2022

Researchers have spotted a threat actor that has managed to extort hundreds of thousands of dollars over the last few months from mostly small and midsize businesses — without using any encryption tools or malware.

Instead, the attacker — dubbed Luna Moth (aka the "Silent" ransomware group) has been using an array of legitimate tools and a technique dubbed "call-back phishing." The tactic is to steal sensitive data from victim organizations and use it as leverage to extort money from them.
Click to expand...

Most of the attacks so far have targeted smaller organizations in the legal industry; more recently, though, the adversary has begun going after larger companies in the retail sector as well, researchers from Palo Alto Network's Unit 42 said in a report Monday. The evolution of the attacks suggests the threat actor has become more efficient with its tactics and now presents a danger to businesses of all sizes, the security vendor warned.

Call-back phishing is a tactic that security researchers first observed the Conti ransomware group using more than a year ago in a campaign to install BazarLoader malware on victim systems.
Call-Back Phishing
The scam starts with an adversary sending a phishing email to a specific, targeted individual at a victim organization. The phishing email is custom made for the recipient, originates from a legitimate email service, and involves some kind of a lure to get the user to initiate a phone call with the attacker.
Click to expand...

In the Luna Moth incidents that Unit 42 researchers observed, the phishing email contains an invoice — in the form of a PDF file — for a subscription service in the recipient's name. The attackers inform the victim the subscription will soon become active and get billed to the credit card number on file.

"This invoice even includes a unique tracking number used by the call center," Russo says. "So, when the victim calls the number to dispute the invoice, they look like a legitimate business."
The attackers then convince users who called to initiate a remote session with them using the Zoho Assist remote support tool.

"In cases where the attacker established persistence, exfiltration occurred hours to weeks after initial contact. Otherwise, the attacker only exfiltrated what they could during the call," Unit 42 said in its report.
Click to expand...

Palo Alto Networks - Unit42: Threat Assessment: Luna Moth Callback Phishing Campaign

By Kristopher Russo - November 21, 2022
Executive Summary
Unit 42 investigated several incidents related to the Luna Moth/Silent Ransom Group callback phishing extortion campaign targeting businesses in multiple sectors including legal and retail. This campaign leverages extortion without encryption, has cost victims hundreds of thousands of dollars and is expanding in scope.

By design, this style of social engineering attack leaves very few artifacts because of the use of legitimate trusted technology tools to carry out attacks. However, Unit 42 has identified several common indicators implying that these attacks are the product of a single highly organized campaign. This threat actor has significantly invested in call centers and infrastructure that’s unique to each victim.
Click to expand...

Log in or Sign up

Threat groups are adopting 'BazarCall' (BazaCall) Phishing Attacks as an Initial Attack Vector

guest Guest

guest Guest

guest Guest

Log in or Sign up

Threat groups are adopting 'BazarCall' (BazaCall) Phishing Attacks as an Initial Attack Vector

guest Guest

guest Guest

guest Guest

Useful Searches