Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
Our SOC analysts have discovered and analyzed a new phishing campaign targeting banks in Pakistan. These phishing emails successfully bypassed the email security controls and targeted multiple users in an enterprise environment. The email uses the subject Password Change Request Accepted, to create an urgency to trigger user response, as users will suspect that someone is attempting to change their password and would immediately take action. The sender’s email address is from the domain administrator[.]com which is detected as malicious on threat intel forums.
The email offers a Cancel Request button, which a user will click on, in order to prevent a password change attempt. Upon clicking the cancel request button, user will be redirected to a URL which is a fake login page for roundcube webmail service designed for credential harvesting. The website uses strict validations and has a SSL certificate as an advanced deception technique which tricks the users into believing that the page is secure and legitimate.
Once the user enters the credentials, they will be redirected to the same username domain. For example, if the user entered “User@rewterz.com” the user would be redirected to the rewterz mail domain. The embedded code is crafted in a way that it reads the email entered in the username field and parses its domain.
Sender contains : “no-reply[@]administrator[.]com” or “@administrator.com”
Subject contains : “Password change request accepted”
URL contains : “output.[your environment name]bin.com/hodiqis” for example : “output.rewterzbin.com/hodiqis”