A global phishing campaign caught our attention after one of our colleagues was targeted by, and nearly fell victim, to a [social engineering attack]().
The campaign involved more than 800 different scam domains and impersonated around 340 legitimate companies all over the world â including well-known banks, postal services, delivery services, social media, and eCommerce sites, such as Facebook, Booking.com, and other popular sites that see a high volume of traffic.
By leveraging a high-quality, single-page application, the scammers were able to dynamically create a convincing website that impersonated a legitimate site, fooling users into a false sense of security.
Our investigation revealed a [phishing]() campaign that employed sophisticated tactics featuring human interactions to deceive their targets and steal their credit card and bank details. While the origin of this campaign was Russian, the threat actors involved pretended to be Ukrainian.
During our investigation, we analyzed several scam domains and reverse-engineered the front-end application. In this blog post, we will describe the attack infrastructure as a way to inform the broader community.
## Executive Summary
We identified five Russian IPs and 800 different scammed domains associated with this campaign (listed in the IOCs). We traced the campaign back to at least May 2022. The campaign is still running and regularly updated.
In total, we found phishing sites in more than 48 languages impersonating more than 340 companies.
If we take into consideration how long this campaign has been operational, the number of domains scammed, and the variety of languages used, we estimate that thousands of individuals have likely fallen prey and been impacted.
Get ready to take a deep dive into this operation!
## How it all beganâ¦
It all started when a colleague tried selling a car seat on Yad2. Yad2 is a website where you can find all sorts of used, second-hand goods.
He received a WhatsApp message from a potential buyer asking for details about the product. After a few messages, the scammer introduced a deceptive paying service, with the Yad2 branding, and sent him a link (hxxps://yad2[.]send-u[.]online/4765567942451). In addition to the Yad2 logo and branding, the fake site also included an orange button to receive payment.
Figure 1: Fake Yad2 site
The victim was then redirected to the following payment page (Figure 2), which forwarded the credit card details to the scammers.
Figure 2: Payment page
Additionally, the site included a customer support chat interface, allowing the target to contact Yad2. To our surprise, the chatbot answered our questions!
Figure 3: Chatbot
For the purpose of our investigation, we decided to ×´take the bait×´ and submitted an empty, prepaid credit card in order to better understand how the operation worked.
After inserting the credit card details, an SMS message from the credit card company notified us with a payment request from MONODirect, a Ukrainian service. They asked for 4581.00 hryvnia (UAH), the national currency of Ukraine.
Figure 4: SMS message from the credit card company
This was the start of our in-depth investigation!
## First steps
Aside from the scam domain, we used open-source intelligence (e.g. VirusTotal, AlienVault, and others) to progressively extend our view of the campaign and to uncover more domains.
Figure 5 shows a VirusTotal graph with the different domains, IPs, and URLs that illustrate the scale of this campaign.
Figure 5: VirusTotal graph of the campaign
After plotting all of the domains on a timeline, ordered by the creation time (extracted from WHOIS), we determined that the campaign was running for at least a year, starting in May 2022.
Figure 6: Timeline
The domains used for the campaign were created every couple of days in the following format:
target[.]cheap_domain.
For example, we encountered a number of scammed domains related to FedEx:
* fedex.pay-i.cfd
* fedex.send-nl.online
* fedex.faster-deliveryt.online
As you can see, the first part is the target and the second part is the cheap domain.
Additionally, each domain had a short lifespan (only a few days), making it challenging to track and analyze them.
At this point, we realized how large and global this campaign was, and we decided to dive deeper and to uncover as many details as possible.
## Static Analysis
The VirusTotal graph we built gave us the opportunity to compare the structure of different scamming sites.
The first thing we saw was that each site had a main JavaScript page with approximately 50,000 lines of code. It was easy to get lost!
After reviewing the code, we noticed it used a WebPack [minifier]() and was written in Angular.
Figure 7: Angular syntax inside the JavaScript code
In order to understand how the single-page application (SPA) worked, we had to fully analyze the JavaScript code and divide it into sections, one for attackerâs code and one for library code.
A further analysis revealed a list of 320 bank names, located in different countries and their details, in JSON format.
Figure 8: Bank JSON data
But, we were not yet sure how this list was used as part of the scamming process.
As we continued our investigation of the code, we uncovered a list of languages used across the malicious sites. Each language was tagged differently. Alongside the words written in Ukrainian, there was a unicode string “u0445u04tar40u044eu0448u0430u0447u0438u0439”, which in English translates to “khryushachy”. In Russian, this word means “piggy”. What we can infer from this is that the campaignâs architects purposefully selected a seemingly derogatory term as a way to demonstrate disrespect, likely connected to the ongoing war between Russia and Ukraine.
Figure 9: Ukraine language tagged with the word “piggy” in Russian (Translation provided by Imperva Threat Research)
To further our investigation, we automated part of our research process and created a few regular expressions to find URL patterns, function names, outbound requests, and meaningful keywords.
From this operation, we discovered several interesting, and hidden, endpoints:
But what exactly are these endpoints? Could it give us a clue about the phishing site infrastructure?
When trying to access these URLs, we were redirected to /root/login, and we got the following screen:
Figure 10: /root/login screen
By reviewing the source code of the application more closely, we spotted a strange DNS query that was performed by the browser.
Figure 11: Front end security mechanism to hide hidden endpoints
After analyzing the code, we ended up with more questions than answers! So, we adjusted our approach and began studying the behavior of the scam platform.
## Dynamic Analysis (contacting the motherland)
A dynamic approach could give us a precise understanding of the communication between the backend API server and the front-end.
We downloaded all resources of the scam site and replicated it behind a [man-in-the-middle (MITM)]() proxy. Next, we overwrote the serverâs JSON responses to reverse engineer the application.
Figure 12: Partial JSON response from the malicious server
One parameter provided by the server called `templateId`controlled the entire layout and content of the scam page. For example, it could impersonate more than 340 legit sites including FedEx, CapitalBank, PostExpress — just by setting the value of the `templateId` field.
Figure 13: OLX company style stolen when TemplateId=1
Figure 14: DHL company style stolen when TemplateId=13
We also discovered that the `locale` parameter enabled the scam server to customize the front endâs content to the attackerâs desired language. The platform supported 48 languages!
Figure 15: The same scam site with a different locale (left: en, right: ru)
Moreover, by updating the JSON response, scammers could control which payment method they presented to the target.
For example, the picture below shows a payment form of Halyk bank, where a victim must enter three fields: LoginPhone numberID, password, and account number.
We believe these fields were probably used by the attackers to conduct an [account takeover (ATO)]() attack that eventually led to account hijacking.
Figure 16: Payment via a bank account
In total, 320 banks were supported by the platform.
The mystery of the hidden endpoints remained. It appeared that to make the hidden phishing site endpoints only available to the collaborators of the scammers, the front-end JavaScript tried to reach the domain `testSDNservssfg.com`. However, this domain doesnât exist on the Internet, which means it was only available in the network of the collaborators who were involved in the campaign. We added the `testSDNservssfg.com` domain to our hosts file, created a local server listening on port 443, our enabling switch, and supplied the relevant response to the front-end.
By doing this, we discovered the content of the hidden endpoints normally only available to the scammers.
The /root/index was the main page the scammers used to control the platform. Figure 15 below shows that the scammersâ primary language was Russian.
Figure 17: Main page
They developed two main features: `create-bank` and `create-platform`.
The `create-bank` endpoint gave them the ability to add new banks to the current list of 320. It contained a GUI to select the bank logo and all the fields required to âreceiveâ a payment. The output of this method was an updated JSON with the new bank details, which the scammers just needed to insert in the right place within the JavaScript code.
Figure 18: Create-bank endpoint
The `create-platform` endpoint enabled them to create a new template for a new target.
Figure 19: create-platform endpoint
We also discovered a hidden chat interface, and managed to see the conversion from the attackersâ point of view:
Figure 20: The attackersâ secret chat interface (in Russian)
Figure 21: Customer chat interface
Figure 22: The attackersâ secret chat interface translated from Russian to English
The attackerâs backend chat interface was also written in Russian. We assume the attackers used an external translation service to respond in the appropriate language.
A sordid detail to mention is that the scammers referred to their targets as âmammothsâ, while they called themselves âworkersâ. Therefore, we could imply that this malicious operation considered itself a company.
The image the scammers used for the chatbot was identical across all scammed sites. When we did a reverse image search, , we found a fake LinkedIn account, created in 2020, using the same picture (no followers and the current workplace is AJAX).
Figure 23: Fake LinkedIn profile
## Whatâs Next?
We’re still tracking the activity of this threat actor to get more information that can hopefully lead to shutting down its operation.
## Summary
This example illustrates that phishing campaigns are becoming more sophisticated.
We believe Russian actors created this large modular phishing platform and launched a global campaign while pretending to be Ukrainian.
This campaign also featured advanced techniques to fool targets. We enriched the accompanying indicators of compromise [(IOCs) resource]() with the domains we collected from this campaign.
Imperva Threat Research is a team of analysts, researchers, data scientists, and security engineers. The team is always monitoring advanced threats to keep customers one step ahead of evolving threats.
The post [Behind the Scenes of a Tailor-Made Massive Phishing Campaign]() appeared first on [Blog]().Read More
References
Back to Main
