• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2019-1652 – Cisco RV320/RV325 Routers Command Injection Vulnerability
January 28, 2019
Rewterz Threat Alert: The Cobalt gang exploiting Google App Engine to distribute malware through PDF decoy documents
January 29, 2019

Rewterz Threat Alert: New Phishing Campaign Targeting Bank Employees in Pakistan, Faking Identity of Bank Al-Habib

January 28, 2019

SEVERITY: Medium

 

 

CATEGORY: Phishing

 

 

ANALYSIS SUMMARY

 

 

A phishing campaign was observed last week, targeting bank employees in Pakistan, faking the identity of Summit Bank. Another similar and fresher phishing campaign is observed targeting about 266 bank employees in Pakistan, this time faking the identity of Bank Al-Habib.

 

 

The email looks like this:

 

 

 

 

When a user clicks on the link, they’re redirected to the URL ‘https[:]//mitz[.]pk/wp-
content/themes/twentynineteen/fonts/baalhabib/banking[.]php.

The malicious page closely resembles the login page of Bank Al-Habib’s legitimate Internet banking page.

 

 

 

 

Moreover, this is not just credential harvesting. In order to log in, users are required to provide other information by answering multiple questions. Once the information is provided, users are redirected to the original login page of the legitimate website, which is not logged in.

 

 

IMPACT

 

 

  • Information Disclosure
  • Credential Theft

 

 

INDICATORS OF COMPROMISE

 

IP(s) / Hostname(s)

119[.]81[.]101[.]242

100Host[.]com

 

 

URLs

 

 

bankalhabib[.]pk

https[:]//mitz[.]pk/wp-content/themes/twentynineteen/fonts/baalhabib/banking[.]php

 

 

Email Address

 

 

info@bankalhabib[.]pk

 

Email Subject

 

 

BAHL Account On Hold – Urgent Action Required

 

 

REMEDIATION

 

Block the threat indicators at their respective controls and do not click on any email attachments or URLs received through unexpected emails.

  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.