Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
SEVERITY: Medium
CATEGORY: Phishing
ANALYSIS SUMMARY
A phishing campaign was observed last week, targeting bank employees in Pakistan, faking the identity of Summit Bank. Another similar and fresher phishing campaign is observed targeting about 266 bank employees in Pakistan, this time faking the identity of Bank Al-Habib.
The email looks like this:
When a user clicks on the link, they’re redirected to the URL ‘https[:]//mitz[.]pk/wp-
content/themes/twentynineteen/fonts/baalhabib/banking[.]php.
The malicious page closely resembles the login page of Bank Al-Habib’s legitimate Internet banking page.
Moreover, this is not just credential harvesting. In order to log in, users are required to provide other information by answering multiple questions. Once the information is provided, users are redirected to the original login page of the legitimate website, which is not logged in.
IMPACT
INDICATORS OF COMPROMISE
IP(s) / Hostname(s)
119[.]81[.]101[.]242
100Host[.]com
URLs
bankalhabib[.]pk
https[:]//mitz[.]pk/wp-content/themes/twentynineteen/fonts/baalhabib/banking[.]php
Email Address
info@bankalhabib[.]pk
Email Subject
BAHL Account On Hold – Urgent Action Required
REMEDIATION
Block the threat indicators at their respective controls and do not click on any email attachments or URLs received through unexpected emails.