Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
June 2, 2023
Severity High Analysis Summary Shuckworm APT – aka Actinium, Armageddon, Primitive Bear, Gamaredon, and Trident Ursa – is a Russia-backed advanced persistent threat (APT) that has […]June 2, 2023Severity High Analysis Summary StormKitty information stealer is designed to compromise sensitive data from infected systems, such as login credentials, passwords, cryptocurrency wallets, and other valuable […]June 2, 2023Severity High Analysis Summary Tofsee malware has been around since 2016. Once installed on a compromised computer, it can be used to send spam emails and […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
June 2, 2023Severity High Analysis Summary Shuckworm APT – aka Actinium, Armageddon, Primitive Bear, Gamaredon, and Trident Ursa – is a Russia-backed advanced persistent threat (APT) that has […]June 2, 2023Severity High Analysis Summary StormKitty information stealer is designed to compromise sensitive data from infected systems, such as login credentials, passwords, cryptocurrency wallets, and other valuable […]June 2, 2023Severity High Analysis Summary Tofsee malware has been around since 2016. Once installed on a compromised computer, it can be used to send spam emails and […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Rewterz Threat Advisory – Microsoft Windows Server 2016 / Windows 10 Multiple Vulnerabilities
December 18, 2018Rewterz Threat Advisory – A Second Sample of the Shamoon V3 Wiper
December 19, 2018
SEVERITY: HIGH
CATEGORY: PHISHING
PUBLISH DATE: DECEMBER 18, 2018
ANALYSIS SUMMARY
A phishing email campaign has been discovered that pretends to be a non delivery notification from Microsoft Office 365 in an attempt to steal you login credentials. The user will see a message of “Several Messages Undelivered” and prompts the user to click on the “Send Again” link in an order to try to send the emails again.
The phishing email would look like this.
After clicking on the “Send Again” link it’ll redirect you to a phishing site that look alike a legitimate Office 365 login page. The link will end with #[emailaddress], for example #@john@doe.com, which will cause the email address to auto-populate.
The phishing site would look like this.
When a user enters their password, a JavaScript function called sendmails() will send the email address and entered
password to the sendx.php script and then redirect you to the legitimate https://outlook.office365.com/owa/?real Office 365 login URL.
IMPACT:
Exposure of credentials
AFFECTED PRODUCTS:
Microsoft Office 365
THREAT INDICATORS:
Email subject: Several Undelivered Messages
REMEDIATION:
As end users, always look out for the correct site. A URL would be the most stand out thing when you’re entering your credentials because phishing are more common, deceptive and potentially harder to notice and users would enter their credentials by seeing a look-alike login page.