• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Spear Phishing Campaign Targeting Finance and Banking Industry
December 8, 2020
Rewterz Threat Alert – APT34 (OilRig) Fresh Campaign – IoCs
December 9, 2020

Rewterz Threat Alert – Spear-Phishing Email Spoofs Microsoft Domain

December 9, 2020

Severity

Medium

Analysis Summary

A spear phishing campaign is observed targeting victims for harvesting credentials, using domain spoofing. The campaign is spoofing the official Microsoft.com domain name and targeting users of the company’s Office 365 suite. So far, the phishing email has been traced in few thousand mailboxes, while putting nearly 200 million users of Office 365 at risk. The messages originate with a spoofed domain that is an exact replica of the Microsoft.com domain, a technique called exact domain spoofing. The spear-phishing emails, so far, have targeted Office 365 users in the financial services, healthcare, insurance, manufacturing, utilities and telecom industries. In this campaign, the fraudsters are likely attempting to harvest users’ credentials. 

Fresh Spear-Phishing Email Spoofs Microsoft Domain


The link will redirect users to a security portal in which they can review and take action on ‘quarantined messages’ captured by the Exchange Online Protection (EOP) filtering stack. If a user clicks the link, they are directed to input their legitimate Office 365 login credentials on a fake login page. It is important to note that these phishing emails are bypassing secure email gateways installed by the targeted companies.

Impact

  • Credential Theft
  • Email Gateway Security Bypass

Remediation

  • Do not respond to emails containing links, unless the sender is personally known and verifies having sent the email.

  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.