Rewterz Threat Alert – Phishing Emails Targeting Banks in Pakistan

Severity

High

Analysis Summary

Our SOC analysts have discovered and analyzed a new phishing campaign targeting banks in Pakistan. These phishing emails successfully bypassed the email security controls and targeted multiple users in an enterprise environment. The email uses the subject Password Change Request Accepted, to create an urgency to trigger user response, as users will suspect that someone is attempting to change their password and would immediately take action. The sender’s email address is from the domain administrator[.]com which is detected as malicious on threat intel forums. 

The email offers a Cancel Request button, which a user will click on, in order to prevent a password change attempt. Upon clicking the cancel request button, user will be redirected to a URL which is a fake login page for roundcube webmail service designed for credential harvesting. The website uses strict validations and has a SSL certificate as an advanced deception technique which tricks the users into believing that the page is secure and legitimate.

Once the user enters the credentials, they will be redirected to the same username domain. For example, if the user entered “User@rewterz.com” the user would be redirected to the rewterz mail domain. The embedded code is crafted in a way that it reads the email entered in the username field and parses its domain. 

Impact

• Credential Theft
• Business Email Compromise

Indicators of Compromise

Email Subject

• Password change request accepted

From Email

• no-reply@administrator[.]com

URL

• https[:]//output[.]jsbin[.]com/hodiqis

Remediation

• Block the threat indicators at their respective controls.
• If a security alert email looks very legitimate, do not respond to it without confirming legitimacy from network administrators.
• Search for IoCs in your environment. Use the following detection technique to identify the possible threat on respective controls:

Sender contains : “no-reply[@]administrator[.]com” or “@administrator.com”

Subject contains : “Password change request accepted”

URL contains : “output.[your environment name]bin.com/hodiqis” for example : “output.rewterzbin.com/hodiqis”