Sophisticated Voice Phishing Campaigns Don’t Exploit Any Software Vulnerabilities
An upsurge of attempts to snare employees in voice phishing campaigns is active and ongoing right now, warn security experts who advise battening down corporate identity verification processes.
See Also: On-Demand | NYDFS MFA Compliance: Real-World Solutions for Financial Institutions
The campaigns, often attributable to the ShinyHunters cybercrime gang, have bypassed some types of multifactor authentication defenses, allowing criminals to ransack organizations’ software-as-a-service applications.
Dozens of organizations have already been targeted, with attackers often trying to gain access to an organization’s Okta or Microsoft Entra ID – formerly Azure Active Directory – identity platforms.
Attackers’ repeat goal has been to gain access to an organization’s single sign-on portal and follow wherever it will let them go, then hold stolen data to ransom, said Google Cloud’s Mandiant incident response group. Victims have lost sensitive data being stored in such systems as Salesforce, Google Workspace, DocuSign, Atlassian, Slack, OneDrive and SharePoint.
Using a social engineering tactic known as vishing – for voice phishing – attackers since early January have been phoning targets, oftentimes pretending to be part of the IT team. They guide victims to a phishing site with a legitimate-looking URL that’s designed to steal password and multifactor authentication credentials (see: Social Engineering Hackers Target Okta Single Sign On).
Based on the latest tactics, techniques and procedures being used, guidance from Mandiant recommends all organizations harden the security surrounding MFA enrollment and changes, maintain detailed logs and actively monitor them to quickly detect signs of a successful vishing attack. The group released indicators of compromise to help with detecting attacks and threat hunting.
Okta has notified customers about a surge in these attacks, facilitated by the latest generation of feature-rich phishing toolkits (see: Voice Phishing Okta Customers: ShinyHunters Claims Credit).
Attackers appear to have done their homework in advance, including knowing which identity apps a target is using, and spoofing the legitimate IT help desk phone number, Okta said. In successful attacks, “the threat actor verbally convinced victims to navigate to websites like [companyname]internal.com, which hosted login pages that mimicked what the victims were used to, said Charles Carmakal, CTO of Google Cloud’s Mandiant, on LinkedIn.
“The threat actor would then walk them through the authentication process and capture their credentials and MFA codes, which would be used by the actor to log into the company’s SSO portal,” he said.
Cybersecurity firm Sophos told Information Security Media Group that attackers appear to be registering a spoofed domain prior to targeting any organization, and that it’s found signs of 150 such domains being registered. Threat intelligence firm Silent Push last week listed 100 organizations for which it’s “detected active targeting or infrastructure preparation” targeting their domains.
No Quick Fix
One challenge for defenders is there’s no easy patch for low-tech trickery.
“This activity is not the result of a security vulnerability in vendors’ products or infrastructure,” Mandiant said. “It continues to highlight the effectiveness of social engineering and underscores the importance of organizations moving towards phishing-resistant MFA where possible.”
Phishing-resistant MFA includes physical security keys compliant with the FIDO standard and device-level authentication known as passkeys.
Rethinking verification processes to make them more difficult to spoof is another top recommendation, as is watching for signs of suspicious behavior after any new device gets enrolled or if there’s a major change to enrollment, activation or authentication.
At the first sign of potential trouble or an increase in incoming attacks, Mandiant recommends a number of “rapid containment steps,” which can include temporarily revoking “all active session tokens and OAuth authorizations” for identity and software-as-a-service platforms, pausing MFA enrollment and password resets, restricting access from virtual private networks and limiting access to corporate-issued and managed devices.
“During periods of heightened threat activity,” organizations should “temporarily route all password and MFA resets through a rigorous manual identity verification protocol,” such as using a “live video verification process,” it said. Another recommendation for help desks: never respond to SMS messages supposedly sent by employees, and for any incoming support calls, immediately phone the employee back on a known-good number to verify their identity.
Google Threat Intelligence Group is tracking three clusters of threat activity tied to these attacks, including one it tracks as UNC6240, which last year used vishing to target Salesforce data. Those threat actors “consistently claimed to be the threat group ShinyHunters,” Google wrote at the time.
Another cluster, tracked as UNC6661, has been tied to many of the more complex vishing attacks that began last month.
Also, starting in early January, another cluster tracked as UNC6671 has used similar tactics, but differs in that it’s also used “PowerShell to download sensitive data from SharePoint and OneDrive.” It hasn’t asserted a cybercrime identity, instead sending unbranded extortion email to victims. The ID number for the threat activity’s Tox end-to-end encrypted instant messaging system – for victim negotiations – is different from previous ShinyHunters Ids. Threat actors also “employed aggressive extortion tactics” including harassing personnel at victim organizations, Google said.
Ransom notes received by some victims threaten “irreversible consequences,” including “public disclosure of all compromised data, including sensitive information about employees, customers and partners,” unless a victim pays a ransom in bitcoin within 72 hours.
A data-leak site launched under the name of ShinyHunters in late January began listing some alleged victims, pressuring them to pay.
At least some victims do appear to have paid in return for a promise to delete stolen data and not name their organization, experts said. Allison Nixon, сhіеf rеѕеаrсh оffісеr аt threat intelligence firm Unіt 221В, urged victims to never pay, warning that they’ll be directly funding cybercrime and receiving nothing in return.
“There is no benefit to paying the ransom for this group,” she said in a post to LinkedIn. “This is a scam by actors who will not delete their data and cannot prove they did and do have a track record of lying.”