SharePoint Island Hopping: Phishing with compromised accounts

-

 

Phishing threat actors continue to launch successful credential harvesting campaigns via compromised Office 365 accounts. One of the most common themes for these campaigns is a "shared file" notification, whereby a compromised account shares a file with a user that is hosted in the SharePoint drive. The file is usually a PDF document that contains a URL to an external site embedded in an "open document" or "view file" button. If the user clicks on it and enters their credentials they are redirected to login.microsoftonline.com.

Although this is an older scam, that has been around for several years, it is still highly effective and is being used to leap from one organisation to another. In this blog, I will analyse a long running phishing campaign that has compromised at least 45 different SharePoint accounts belonging to a variety of organisations over the last year.

Fig. 1 - The typical phishing chain used in this campaign

Fig. 2 - Various PDF documents hosted in compromised SharePoint storage accounts

Fig. 3 - JavaScript to collect form data, exfiltrate the credentials, and redirect the user

Attributes of this phishing campaign which largely remained the same each time:

  • The phishing email is a "shared file" notification sent by the compromised account
  • The attackers use a PDF hosted on SharePoint with an embedded URL
  • The URL would point to a *.hostingerapp[.]com hostname with the fake OneDrive login page
  • Two files called 1.html and next.php collect the credentials and redirect the user
  • Users are redirected to login.microsoftonline.com if they enter credentials

Further investigation into the campaign revealed other variations of the attack, which still uses the core attributes such as PDFs with embedded URLs and the same OneDrive phishing kits on *.hostingerapp[.]com hostnames.

Fig. 4 - A compromised Gmail account variant of this attack

Fig. 5 - An Automated Clearing House (ACH) style attack using core[.]opentext[.]com

Analysis:

There is a variety of organisations impacted by this campaign, as seen in the IOCs section below. This includes US schools and colleges, engineering firms, professional services, logistics firms, and manufacturers, among others. This seemingly random variety indicates it is an opportunistic spam campaign rather than targeted spear-phishing attacks. However, acquiring access to a large number of Office 365 accounts at various organisations could lead to targeted follow on attacks and subsequent malware or business email compromise (BEC) incidents. We often see threat actors create auto-forwarding rules on these accounts that monitor for keywords such as "invoice", "ACH", "RFQ", "payment", "order", and so on. The forwarded emails are then reviewed and the threat actors can follow up with a fake "invoice" or "update ACH" email posing as one of the organisation's partners.

By using *.hostingerapp[.]com hostnames the threat actors are able to hijack any pre-established trust associated with a given service's IP addresses and domains. These legitimate services are often abuse by cybercriminals to evade detection and slip past secure email gateways (SEG) and intrusion detection systems (IDS). This campaign uses several steps to evade detection systems, chiefly the use of hijacked SharePoint accounts and shared file notications to distribute the phishing documents. There is very little variation in these attacks during the entire year-long campaign, which goes to show it is a tried and tested, reliable technique for these cybercriminals to successfully harvest credentials.

Defenders should consider blocking or reviewing *.hostingerapp[.]com hostnames. Not only is it used in this long-running phishing campaign but also by a variety of malware families in 2018/19, such as AZORult, Imminent RAT, NanoCore RAT, and the Megalodon Stealer. [1, 2, 3, 4]

All organisations need to avoid becoming part of these campaigns. This includes enforcing multi-factor authentication (MFA), enforcing a timely password reset policy for all Office 365 accounts, removing accounts of employees who have left the organisations, and monitor for the creation of any email forwarding rules. It may also be worth monitoring for IP addresses and devices of the users logging into their Office 365 accounts. If a user who usually logs in via Google Chrome from the US or UK everyday suddenly logs in from Russia or Nigeria via Firefox it is worth investigating.

References:

  1. https://twitter.com/James_inthe_box/status/1069611890802778112?s=20
  2. https://twitter.com/KorbenD_Intel/status/1163929665230299137?s=20
  3. https://twitter.com/p5yb34m/status/1167130345965117440?s=20
  4. https://twitter.com/James_inthe_box/status/1075766442849533952?s=20

Indicators of Compromise (IOCs):

Malicious *.hostingerapp[.]com hostnames:

  • 09jsl8-msd9smdi-29ims[.]hostingerapp[.]com
  • brait3rm-pr0slamdoc8r[.]hostingerapp[.]com
  • crearny-piesugat[.]hostingerapp[.]com
  • dreamlessdocb-offlinprodoc[.]hostingerapp[.]com
  • ericbrown-scudoc[.]hostingerapp[.]com
  • evelyndocument-lastingsecur7[.]hostingerapp[.]com
  • gr8testb1coin-84mfh40pro[.]hostingerapp[.]com
  • homy-preparations[.]hostingerapp[.]com
  • kristaz-doguments[.]hostingerapp[.]com
  • lencrpted-trumetmsg[.]hostingerapp[.]com
  • lifedoubledoc-sharepr0m[.]hostingerapp[.]com
  • lightening-securesolo[.]hostingerapp[.]com
  • mymovez[.]hostingerapp[.]com
  • pr0spertie54-quadr9pop[.]hostingerapp[.]com
  • prestige-onedr1ve-docc[.]hostingerapp[.]com
  • prirmary-mgcheck[.]hostingerapp[.]com
  • sleh94manne3-oxt93m049[.]hostingerapp[.]com
  • smallows3r-smallows3r[.]hostingerapp[.]com
  • sparow-sparow24[.]hostingerapp[.]com
  • special707-o49mdpr0[.]hostingerapp[.]com
  • speeedie24hs-documents365[.]hostingerapp[.]com
  • torexserv-pieblokdoc[.]hostingerapp[.]com
  • trptap-mytprojatv[.]hostingerapp[.]com
  • worldrm-fintechz[.]hostingerapp[.]com
Hijacked SharePoint accounts hosting PDFs with embedded URLs:
  • mycentenary-my[.]sharepoint[.]com
  • dmscan-my[.]sharepoint[.]com
  • hsincorporated-my[.]sharepoint[.]com
  • katherinefrank-my[.]sharepoint[.]com
  • vivexbiomedical-my[.]sharepoint[.]com
  • universaltechnologies-my[.]sharepoint[.]com
  • amwarelogistics-my[.]sharepoint[.]com
  • collierschools-my[.]sharepoint[.]com
  • mteck-my[.]sharepoint[.]com
  • hdceicom-my[.]sharepoint[.]com
  • mapitgo-my[.]sharepoint[.]com
  • nitcoinc-my[.]sharepoint[.]com
  • blackbeltinsurors-my[.]sharepoint[.]com
  • tmxno-my[.]sharepoint[.]com
  • pyrongroup-my[.]sharepoint[.]com
  • evolutioninsurecom-my[.]sharepoint[.]com
  • groceryoutletinc-my[.]sharepoint[.]com
  • covga-my[.]sharepoint[.]com
  • metrojacksonobgyn-my[.]sharepoint[.]com
  • bbmkbtr-my[.]sharepoint[.]com
  • mpcyak-my[.]sharepoint[.]com
  • groceryoutletinc-my[.]sharepoint[.]com
  • mstfdonor-my[.]sharepoint[.]com
  • h2otreat-my[.]sharepoint[.]com
  • tamakilaw-my[.]sharepoint[.]com
  • azliver-my[.]sharepoint[.]com
  • doddburnham-my[.]sharepoint[.]com
  • phgllc-my[.]sharepoint[.]com
  • dnaz-my[.]sharepoint[.]com
  • ericryan-my[.]sharepoint[.]com
  • mortgagemasters-my[.]sharepoint[.]com
  • broadbandhospitality-my[.]sharepoint[.]com
  • regionallandtitle-my[.]sharepoint[.]com
  • regionaltitleservices-my[.]sharepoint[.]com
  • pawpawtownship-my[.]sharepoint[.]com
  • inopo-my[.]sharepoint[.]com
  • enterprisesinc-my[.]sharepoint[.]com
  • whittyengineering478-my[.]sharepoint[.]com
  • eeiengineers-my[.]sharepoint[.]com
  • netorg5047480-my[.]sharepoint[.]com
  • matx-my[.]sharepoint[.]com
  • priority1inc-my[.]sharepoint[.]com
  • westgatemfg-my[.]sharepoint[.]com
  • shawlundquist-my[.]sharepoint[.]com
  • metrojacksonobgyn-my[.]sharepoint[.]com

Popular posts from this blog

Raspberry Robin: A global USB malware campaign providing access to ransomware operators

-
Image
Logo credit: RedCanary Ever since it first appeared in late 2021, the Raspberry Robin malware campaign has been propagating globally. A number of threat intelligence reports by vendors such as RedCanary (who named it) and Microsoft (who track it as DEV-0856/Storm-0856) have covered the malware campaign in great detail.  In fact, the list of blogs I do recommend to read to catch up on this threat are as follows: https://redcanary.com/blog/raspberry-robin https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity https://blog.sekoia.io/raspberry-robins-botnet-second-life/ https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/ https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/ https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-sprea...
Read more

Lessons from the iSOON Leaks

-
Image
  Introduction A Chinese Ministry of Public Security (MPS) contractor called  iSOON (also known as Anxun Information) that  specializes in network penetration research and related services has had its data leaked to GitHub. Based on the level of detail, leaked chat logs, amount of data, and corroboration from overlaps indicators of compromise (IOCs), there is a high level of confidence it is legit. Preliminary findings from less than one week since the leak revealed that it contains unprecedented insights into how the Chinese MPS operates by using Chinese commercial surveillance vendors and what their technical capabilities are. The Chinese MPS is China’s internal security service that primarily focuses on  internal and border security, counter-terrorism, surveillance. The MPS is comparable to the  Russian FSB, the US DHS or the UK’s MI5. The most interesting findings have come from iSOON’s product whitepapers and confidential slide deck presentations given to t...
Read more

The Ransomware Tool Matrix

-
Image
Introduction Ransomware attacks are becoming increasingly damaging, but one thing remains consistent: the tools these cybercriminals rely on. The Ransomware Tool Matrix is a comprehensive resource that sheds light on the tactics, techniques, and procedures (TTPs) commonly used by ransomware and extortionist gangs. This repository provides defenders with actionable intelligence on the tools frequently leveraged by adversaries, thanks to the insights shared publicly by the US Cybersecurity and Infrastructure Security Agency (CISA)'s #StopRansomware advisories and The DFIR Report's publications, among others. This repository offers straightforward insights from compiled open source intelligence (OSINT) research that can be directly applied to threat hunting, detection engineering, and incident response operations. Project Background As defenders, we can turn the tables by exploiting a crucial flaw committed by ransomware gangs: tool reuse. Many ransomware gangs repeatedly rely on ...
Read more