Rewterz Threat Alert – Phishing campaign targeting bank employees in Pakistan

SEVERITY: Medium

ANALYSIS SUMMARY

The Phishing email with the subject “Summit Bank Account Locked” pretends to be coming from the legitimate bank, using the email address ibsupport[@]summitbank[.]pk and targets employees of other banks. It contains a fake URL leading to a login page. While the legitimate URL of Summit Bank’s internet banking log-in page is https://ib.summitbank.com.pk/ib.login.do, the URL received through email was https://latamvapea[.]com/mails/nl/summit/summit[.]html/. The page latamvapea itself is a legitimate but compromised vapeselling site.

The email looks like this:

Moreover, while only port 443 is open on the legitimate site, the fake site has port 80, 443 and 81 open as well. 81 can be used for web services but if it’s idle it can be widely used as a RAT (remote access Trojan).

IMPACT

Credential theft

INDICATORS OF COMPROMISE

URLs

• https://latamvapea[.]com/mails/nl/summit/summit[.]html
• summitbank[.]pk

Email Address

• ibsupport[@]summitbank[.]pk

Email Subject

Summit Bank Account Locked

Remediation

• Block the threat indicators at their respective controls.
• Strictly avoid opening unexpected emails even if they look harmless.
• Always be skeptical about the authenticity of URLs.

If you think you’re a victim of a cyber-attack, immediately send an email to soc@rewterz.com for a quick response.