Weekly Threat Briefing: Data Breach, Ransomware, Spyware, and More

<div id="weekly">The various threat intelligence stories in this iteration of the Weekly Threat Briefing discuss the following topics: Android Malware, Bluetooth, Phishing, Winnti Group , WolfRAT, and Vulnerabilities. The IOCs related to these stories are attached to the Weekly Threat Briefing and can be used to check your logs for potential malicious activity. <img src="https://cdn.filestackcontent.com/gfZM4ud0QrC4nGgeJqwF"/> Figure 1 - IOC Summary Charts. These charts summarize the IOCs attached to this magazine and provide a glimpse of the threats discussed.<div id="trending-threats"><h2 id="trendingthreats">Trending Cyber News and Threat Intelligence</h2><h3 id="article-1" style="margin-bottom:0;"><a href="https://www.bleepingcomputer.com/news/security/discord-client-turned-into-a-password-stealer-by-updated-malware/" target="_blank">Discord Client Turned Into a Password Stealer By Updated Malware</a></h3>(published: May 24, 2020)An unnamed threat actor has modified the AnarchyGrabber trojan to steal the passwords and user tokens of Discord users as well as disable Two Factor Authentication (2FA). AnarchyGrabber is publicly available for download from criminal forums and Youtube videos. Threat actors would distribute the trojan to discord servers masquerading it as copyrighted software or game cheats. Previous versions of AnarchyGrabber would modify the Discord client's Javascript files in order to grab user tokens. The latest version called "AnarchyGrabber3" modifies Discord's index.js file allowing threat actors to steal user passwords and spread the trojan to everyone on the user's friends list. This latest version is difficult to detect because once the trojan has conducted its operations it will remove itself to evade detection from antivirus products. Recommendation: In order to identify whether or not a user's Discord client has been compromised by this latest version of AnarchyGrabber, they must view the "index.js" file. This can be found at "%AppData%Discord[version]modulesdiscord_desktop_coreindex.js file" and if the file does not have this single line in it, "module.exports = require('./core.asar');" then the client is likely to be infected. The best action to take once this has been identified is to uninstall the client completely and reinstalled it. You must also notify all individuals on your friends list as they have also potentially have been compromised by the Trojan. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947231">[MITRE ATT&CK] Valid Accounts - T1078</a> | <a href="https://ui.threatstream.com/ttp/947164">[MITRE ATT&CK] File Deletion - T1107</a> | <a href="https://ui.threatstream.com/ttp/947205">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/2402630">[MITRE PRE-ATT&CK] Conduct social engineering - T1268</a> | <a href="https://ui.threatstream.com/ttp/2402535">[MITRE ATT&CK] Service Stop - T1489</a> | <a href="https://ui.threatstream.com/ttp/3297602">[MITRE ATT&CK] Steal Application Access Token - T1528</a> Tags: AnarchyGrabber3, Botnet, Discord, Password Stealer<h3 id="article-2" style="margin-bottom:0;"><a href="https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/" target="_blank">Ragnar Locker Ransomware Deploys Virtual Machine To Dodge Security</a></h3>(published: May 21, 2020)The Ragnar Locker Ransomware has been seen in recent attacks deploying itself within a virtual machine on target systems in new methods to evade detection. The threat actors behind Ragnar Locker used a GPO task to execute a Microsoft installer to download an MSI package that contained an installation for VirtualBox and a virtual disk image for Windows XP. The software and image would be stored within the "C:Program Files(x86)"VirtualApplicances" directory to appear as legitimate. The MSI installer will also install scripts that will disable Windows AutoPlay notifications and any shadow volumes existent. This same script will enumerate all local disk, mapped network drives, and removable drives so that they can be accessed by the virtual machine. The ransomware is executed with a batch file stored in the startup folder to provide persistence and once executed, the ransomware will encrypt files from all the available drives previously enumerated. The ransom note for each target will be unique since the ransomware is compiled solely for each user. Recommendation: Ransomware can potentially be blocked by using endpoint protection solutions (HIDS). Always keep your important files backed up following the 3-2-1 rule: have at least 3 different copies, on 2 different mediums, with 1 off-site. In the case of ransomware infection, the affected system must be wiped and reformatted. Other devices on the network should be checked for similar infections. Always check for a decryptor before considering payment; avoid payment at all costs. Ransomware should be reported to law enforcement agencies who are doing their best to track these actors and prevent ransom from being a profitable business for cyber criminals. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947207">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/2336969">[MITRE ATT&CK] Registry Run Keys / Startup Folder - T1060</a> | <a href="https://ui.threatstream.com/ttp/947195">[MITRE ATT&CK] File and Directory Discovery - T1083</a> | <a href="https://ui.threatstream.com/ttp/947123">[MITRE ATT&CK] Network Share Discovery - T1135</a> | <a href="https://ui.threatstream.com/ttp/947145">[MITRE ATT&CK] Signed Binary Proxy Execution - T1218</a> | <a href="https://ui.threatstream.com/ttp/2402695">[MITRE PRE-ATT&CK] Install and configure hardware, network, and systems - T1336</a> | <a href="https://ui.threatstream.com/ttp/2402531">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a> | <a href="https://ui.threatstream.com/ttp/2402534">[MITRE ATT&CK] Inhibit System Recovery - T1490</a> Tags: Ragnar Locker, Ransomware, Virtual Machine, Windows XP<h3 id="article-3" style="margin-bottom:0;"><a href="https://blog.reasonsecurity.com/2020/05/21/undetect-me-if-you-can/" target="_blank">Undetect Me If You Can</a></h3>(published: May 21, 2020)A new variant of the information stealing malware family "Raccoon" was discovered by Research Labs researchers masquerading as legitimate software. New samples seen will attempt to impersonate legitimate programs that include Bandicam and Revo Uninstaller. This latest version of this trojan is written in Borland Delphi and will target different browsers to collect sensitive data as well as perform screen capture and collect keystrokes of users. Raccoon will use a PowerShell script to disable Windows Defender and modify registry key values to disable the admin approval prompt for the payload to be executed. Recommendation: Threat actors are always adapting to the security environment to remain effective. New techniques can still be spotted with behavioural analysis defenses and social engineering training. Ensure that your company's firewall blocks all entry points for unauthorized users, and maintain records of how normal traffic appears on your network. Therefore, it will be easier to spot unusual traffic and connections to and from your network to potentially identify malicious activity. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947141">[MITRE ATT&CK] Masquerading - T1036</a> | <a href="https://ui.threatstream.com/ttp/947243">[MITRE ATT&CK] Input Capture - T1056</a> | <a href="https://ui.threatstream.com/ttp/947287">[MITRE ATT&CK] PowerShell - T1086</a> | <a href="https://ui.threatstream.com/ttp/947115">[MITRE ATT&CK] Disabling Security Tools - T1089</a> | <a href="https://ui.threatstream.com/ttp/947289">[MITRE ATT&CK] Custom Command and Control Protocol - T1094</a> | <a href="https://ui.threatstream.com/ttp/947079">[MITRE ATT&CK] Screen Capture - T1113</a> | <a href="https://ui.threatstream.com/ttp/3297571">[MITRE ATT&CK] Credentials from Web Browsers - T1503</a> Tags: Raccoon, Information Stealer, Screen Capture, Input Capture<h3 id="article-4" style="margin-bottom:0;"><a href="https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/" target="_blank">No "Game Over" For The Winnti Group</a></h3>(published: May 21, 2020)Researchers at WeLiveSecurity have detected a new modular backdoor named "PipeMon," that is being used by the China-based Advanced Persistent Threat (APT) group called "Winnti Group." Winnti is using Pipepon to target video game companies in South Korea and Taiwan. Recommendation: As this story portrays, it is important that your company institute policies regarding software in use and proper maintenance. New security updates should be applied as soon as possible because they often fix minor bugs and critical vulnerabilities that delay work-flow or can be exploited by malicious actors. Third-party software vendors must ensure that their software is secure frequently to avoid customers falling victim to cyber threats due to their own vulnerabilities. Digital certificates are a common platform for threat actors to conduct supply-chain attacks and third parties must have steps in place to ensure that certificates are only being used by authenticated and authorized individuals. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947105">[MITRE ATT&CK] Port Monitors - T1013</a> | <a href="https://ui.threatstream.com/ttp/947269">[MITRE ATT&CK] Access Token Manipulation - T1134</a> | <a href="https://ui.threatstream.com/ttp/947258">[MITRE ATT&CK] Bypass User Account Control - T1088</a> | <a href="https://ui.threatstream.com/ttp/3297569">[MITRE ATT&CK] Parent PID Spoofing - T1502</a> | <a href="https://ui.threatstream.com/ttp/947101">[MITRE ATT&CK] Code Signing - T1116</a> | <a href="https://ui.threatstream.com/ttp/947235">[MITRE ATT&CK] Obfuscated Files or Information - T1027</a> | <a href="https://ui.threatstream.com/ttp/947166">[MITRE ATT&CK] Modify Registry - T1112</a> | <a href="https://ui.threatstream.com/ttp/947142">[MITRE ATT&CK] Process Injection - T1055</a> | <a href="https://ui.threatstream.com/ttp/947207">[MITRE ATT&CK] Process Discovery - T1057</a> | <a href="https://ui.threatstream.com/ttp/947109">[MITRE ATT&CK] Security Software Discovery - T1063</a> | <a href="https://ui.threatstream.com/ttp/947079">[MITRE ATT&CK] Screen Capture - T1113</a> | <a href="https://ui.threatstream.com/ttp/947291">[MITRE ATT&CK] Commonly Used Port - T1043</a> | <a href="https://ui.threatstream.com/ttp/947250">[MITRE ATT&CK] Standard Non-Application Layer Protocol - T1095</a> | <a href="https://ui.threatstream.com/ttp/947150">[MITRE ATT&CK] Standard Cryptographic Protocol - T1032</a> | <a href="https://ui.threatstream.com/ttp/947283">[MITRE ATT&CK] Fallback Channels - T1008</a> Tags: Winnti Group, PipeMon, Backdoor, South Korea, Taiwan<h3 id="article-5" style="margin-bottom:0;"><a href="https://www.proofpoint.com/us/blog/threat-insight/zloader-loads-again-new-zloader-variant-returns" target="_blank">ZLoader Loads Again: New ZLoader Variant Returns</a></h3>(published: May 20, 2020)Proofpoint researchers have identified new versions of ZLoader, a variant of the Zeus banking trojan being active since December 2019. Targeted countries have included Australia, Canada, Germany, Poland, and the U.S.A. Email lures being used for Zloader have incorporated COVID-19 prevention and testing scams as well as fake invoices. Since December 2019 and up until the time of reporting, there have been 25 versions of ZLoader identified with version 1.2.24.0 being the most recent. The trojan contains multiple mechanisms in place to evade detection as well as making it hard to reverse engineer. The malware will attempt to steal user credentials from a web browser and will use HTTP POST requests to communicate with the Command and Control (C2). The abilities of Zloader also include stealing cookies from browsers, deleting itself, and blocking user access to certain URLs. It was noted that in version 1.1.22.0 onwards, ZLoader would employ a Domain Generation Algorithm (DGA) in the situation where the malware could not initially communicate to the C2. Recommendation: All employees should be educated on the risks of phishing, specifically, how to identify such attempts using recent and ongoing events like the COVID-19 pandemic, and whom to contact if a phishing attack is identified. Emails that request that the recipient follow a link that then asks for credentials to be entered is often an indicator of a phishing attack. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947289">[MITRE ATT&CK] Custom Command and Control Protocol - T1094</a> | <a href="https://ui.threatstream.com/ttp/947164">[MITRE ATT&CK] File Deletion - T1107</a> | <a href="https://ui.threatstream.com/ttp/947106">[MITRE ATT&CK] Spearphishing Link - T1192</a> | <a href="https://ui.threatstream.com/ttp/947180">[MITRE ATT&CK] Spearphishing Attachment - T1193</a> | <a href="https://ui.threatstream.com/ttp/947205">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/3297571">[MITRE ATT&CK] Credentials from Web Browsers - T1503</a> | <a href="https://ui.threatstream.com/ttp/3297610">[MITRE ATT&CK] Steal Web Session Cookie - T1539</a> Tags: ZLoader, Banking Trojan, Spearphishing<h3 id="article-6" style="margin-bottom:0;"><a href="https://www.bleepingcomputer.com/news/security/adobe-releases-critical-out-of-band-security-update/" target="_blank">Adobe Releases Critical Out-of-Bound Security Update</a></h3>(published: May 20, 2020)Out-of-Band security updates have been made available for Adobe products that include Character Animator, Premier Pro, Audition, and Premiere Rush. The vulnerability for Adobe Character Animator was registered as "CVE-2020-9586," a critical buffer overflow vulnerability which could provide threat actors the ability to execute remote code on a target system. The vulnerabilities for Premiere Pro, Audition and Premiere are classified as Out-Of-Bounds vulnerabilities that would cause information disclosure of sensitive information for threat actors to gain access. Recommendation: It is important that your company has patch-maintenance policies in place, particularly when there are Bring Your Own Device (BYOD) policies in use. Once vulnerabilities have been reported on in open sources, threat actors will likely attempt to incorporate the exploitation of the vulnerability into their malicious operations. Patches should be reviewed and applied as soon as possible to prevent potential malicious activity. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947138">[MITRE ATT&CK] Exploit Public-Facing Application - T1190</a> | <a href="https://ui.threatstream.com/ttp/947244">[MITRE ATT&CK] Exploitation for Client Execution - T1203</a> Tags: Adobe, Remote Code Execution, Information Disclosure, CVE-2020-9586, CVE-2020-9616, CVE-2020-9617, CVE-2020-9618<h3 id="article-7" style="margin-bottom:0;"><a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia" target="_blank">Sophisticated Espionage Group Turns Attention to Telecom Providers in South Asia</a></h3>(published: May 19, 2020)The Advanced Persistent Threat (APT) group "Greenbug" has been seen targeting telecommunication companies in South Asia as recent as April 2020, and are using spearphishing campaigns to provide the first point of entry. The group uses off-the-shelf tools and open source techniques as part of its espionage operations focused on gaining access to database servers and stealing credentials for later access. The group is potentially linked to Iran as well as connections to the Shamoon Group who have been conducting wiping operations against organizations in Saudi Arabia. Evidence was shown to find Greenbug being present on systems prior to the Shamoon Group wiping them. This raises the likelihood of collaboration between the two groups in which Greenbug provides the Shamoon Group credentials for target systems to wipe. Recommendation: Databases should not be directly accessible over, or connected to the internet. Protect these services with authentication, do not allow guest or anonymous login. For web applications that are accessing database data, make sure all user-supplied data is sanitized to prevent SQL injections. Even if the activity of Greenbug and the Shamoon Group is not linked, individuals must update database credentials annually and keep remote copies as backups in the case of being compromised. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947287">[MITRE ATT&CK] PowerShell - T1086</a> | <a href="https://ui.threatstream.com/ttp/947187">[MITRE ATT&CK] System Network Configuration Discovery - T1016</a> | <a href="https://ui.threatstream.com/ttp/947273">[MITRE ATT&CK] Create Account - T1136</a> | <a href="https://ui.threatstream.com/ttp/947180">[MITRE ATT&CK] Spearphishing Attachment - T1193</a> | <a href="https://ui.threatstream.com/ttp/947205">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/2402791">[MITRE PRE-ATT&CK] Upload, install, and configure software/tools - T1362</a> Tags: Greenbug, Telecommunication, Open-Source, Credential Access<h3 id="article-8" style="margin-bottom:0;"><a href="https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html" target="_blank">The Wolf is Back...</a></h3>(published: May 19, 2020)A modified version of the Android Remote Access Tool (RAT) DenDroid called "WolfRAT" has been targeting Android users in Thailand, as discovered by researchers at Cisco Talos. The modified RAT will target messaging applications including Facebook Messenger, Line, and WhatsApp with Cisco Researchers linking it to DenDroid due to strong overlaps in the Command and Control (C2) infrastructure used. The RAT is linked to a German based startup called "Wolf Research", who are known for selling malware and spyware to governments around the world. WolfRAT will attempt to masquerade as a Flash update, GooglePlay or as a Google service to collect sensitive information from Android users. The malware is unsophisticated with much of the code being copied and pasted from open sources. Once Wolf Research was reported on, the company closed down but soon resurfaced in Cyprus under the name "LokD". Recommendation: It is important to only use the Google Play Store to obtain your software (for Android users), and avoid installing software from unverified sources because it is easier for malicious applications to get into third-party stores. Applications that ask for additional permissions outside of their normal functionality should be treated with suspicion, and normal functionality for the applications should be reviewed carefully prior to installation. Antivirus applications, if available, should be deployed on devices, particularly those that could contain sensitive information. Tags: Android, Spyware, WolfRAT, Thailand<h3 id="article-9" style="margin-bottom:0;"><a href="https://www.bleepingcomputer.com/news/security/netwalker-adjusts-ransomware-operation-to-only-target-enterprise/" target="_blank">NetWalker Adjusts Ransomware Operation to Only Target Enterprise</a></h3>(published: May 19, 2020)The threat group CIRCUS SPIDER are moving away from their usage of phishing campaigns to distribute payloads for its NetWalker ransomware, and are now relying on network intrusion of specific large businesses only. On April 19, 2020, the group was seen making job advertisements on a Russian hacking forum looking for individuals with experience in network intrusion to join the group. In the advertisement, the group specified that the potential affiliate must always restore user files once a ransom has been paid and that targeting should not include Russia or the Commonwealth of Independent States (CIS). Recommendation: With ransomware, individuals must always run antivirus and endpoint protection software to assist in preventing ransomware infection. Maintain secure backups of all your important files to avoid the need to consider payment for the decryption key, and implement a business continuity plan in the unfortunate case of ransomware infection. In the case of ransomware infection, the affected systems should be wiped and reformatted, even if the ransom is paid. Other machines on the same network should be scanned for other potential infections. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/2402531">[MITRE ATT&CK] Data Encrypted for Impact - T1486</a> Tags: NetWalker, Ransomware, RaaS, Enterprise<h3 id="article-10" style="margin-bottom:0;"><a href="https://www.bbc.co.uk/news/technology-52722626" target="_blank">EasyJet Admits Nine Million Customers Hacked</a></h3>(published: May 19, 2020)The British airline EasyJet has released information detailing the email addresses and travel details of an estimated nine million customers that have been accessed by unauthorized individuals. The credit card data of 2,208 customers was also accessed during this compromise. EasyJet became alerted to this malicious activity back in January 2020 but only started to inform customers about this breach in late April. Recommendation: Leaks of this sort may cause affected individuals to be at a greater risk of phishing attacks. Actors can use this information to craft custom emails to increase their chances of malicious activity being approved by the recipient. Individuals who have accounts associated with this incident should change their passwords as soon as possible, particularly if passwords for said accounts are the same to other online accounts. Individuals should also regularly monitor their credit reports for suspicious activity or consider an identity theft protection service. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947180">[MITRE ATT&CK] Spearphishing Attachment - T1193</a> | <a href="https://ui.threatstream.com/ttp/947205">[MITRE ATT&CK] User Execution - T1204</a> Tags: EasyJet, Data Breach, PII<h3 id="article-11" style="margin-bottom:0;"><a href="https://www.zdnet.com/article/smartphones-laptops-iot-devices-vulnerable-to-new-bias-bluetooth-attack/" target="_blank">Smartphones, Laptops, IoT Devices Vulnerable to New BIAS Bluetooth Attack</a></h3>(published: May 18, 2020)A vulnerability has been found in the Bluetooth wireless protocol which allows for threat actors to take control of Bluetooth enabled devices. The vulnerability is registered as "CVE-2020-10135" aka Bluetooth Impersonation AttackS (BIAS), which affects all modern devices capable of Bluetooth pairing including IoT devices, laptops, smartphones, and tablets. The vulnerability relates to how devices are initially paired with Bluetooth using a link key. Improper authentication of the post-bonding process of devices allows for threat actors to masquerade as the genuine device and gain access to them using the link key. The Bluetooth chips used by Apple, CSR, Cypress, Intel, Samsung, and Qualcomm are all vulnerable to BIAS attacks unless patched. Recommendation: Since the reporting of CVE-2020-0135, the Bluetooth standards organisation, Bluetooth Special Interest Group (SIG) have released updates to prevent BIAS attacks from occurring. All devices should be kept up-to-date with the latest software versions to use the newest security features implemented in the update. Additionally, only trusted devices should be connected to via Bluetooth, and Bluetooth should be turned off when not in use. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947124">[MITRE ATT&CK] Peripheral Device Discovery - T1120</a> Tags: Bluetooth, CVE-2020-10135, Apple, Intel, Samsung<h3 id="article-12" style="margin-bottom:0;"><a href="https://blog.talosintelligence.com/2020/05/vuln-spotlight-Nitro-pro-pdf-may-2020.html" target="_blank">Vulnerability Spotlight: Multiple Vulnerabilities in Nitro Pro PDF Reader</a></h3>(published: May 18, 2020)Researchers from Cisco Talos have identified two remote code execution vulnerabilities in the Nitro Pro PDF reader registered as "CVE-2020-6074" and "CVE-2020-6092". The first vulnerability allows threat actors to exploit the parser used for reading PDFs by crafting PDF documents causing integer overflow, which enables threat actors to execute arbitrary code. The second vulnerability relates to how the 13.9.1.155 version of Nitro Pro handles XML errors. Specially crafted PDF documents will cause uninitialized memory access resulting in information disclosure. The vulnerabilities can only be exploited once a user has opened these documents which have likely been distributed via spearphishing campaigns. Recommendation: With these vulnerabilities likely to be exploited through spearphishing, individuals should be educated on the risks of it, specifically, how to identify such attempts and whom to contact if a phishing email is identified. Emails that request that the recipient follow a link or open an attachment can often be indicative of a spearphishing attack. Once vulnerabilities have been reported on in open sources like this, threat actors will likely attempt to incorporate the exploitation of the vulnerability into their malicious operations. Patches should be reviewed and applied as soon as possible to prevent potential malicious activity. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947180">[MITRE ATT&CK] Spearphishing Attachment - T1193</a> | <a href="https://ui.threatstream.com/ttp/947244">[MITRE ATT&CK] Exploitation for Client Execution - T1203</a> | <a href="https://ui.threatstream.com/ttp/947205">[MITRE ATT&CK] User Execution - T1204</a> Tags: Nitro Pro PDF Reader, CVE-2020-6074, CVE-2020-6092, Remote Code Execution<h3 id="article-13" style="margin-bottom:0;"><a href="https://cofense.com/mfa-bypass-phish-caught-oauth2-grants-access-user-data-without-password/" target="_blank">MFA Bypass Phish Caught: OAuth2 Grants Access to User Data Without a Password</a></h3>(published: May 18, 2020)Spearphishing tactics involving threat actors taking advantage of the OAuth2 framework and OpenID Connect (OIDC) protocol to access data has been discovered by researchers at Cofense. Emails have been seen masquerading as bonuses for the work quarter and will ask users to visit a SharePoint hosted file which will take them to what appears to be a legitimate Microsoft Office 365 login page. OAuth2 and OIDC are used by Microsoft to provide users access tokens to access Office 365 data. OIDC is used to authenticate users and then will use OAuth2 to authorize Office 365 data access to them. The URL is modified by threat actors so that responses given and the associated tokens and authentication codes of users will be redirected to a different website named hxxps://officehnoc[.]com/office which masquerades as a legitimate Office 365 page. The URL will include a scope parameter to allow threat actors to access email accounts when users are offline, read their contact list, and read emails. Recommendation: Spearphishing emails represent a significant security risk because the sending email will often appear legitimate to the target; sometimes a target company email is compromised and used for such emails. Education is the best defense, inform your employees on what to expect for information requests from their managers and colleagues. Employees should also be aware of whom to contact when they suspect they are the target of a possible spearphishing attack. MITRE ATT&CK: <a href="https://ui.threatstream.com/ttp/947098">[MITRE ATT&CK] Email Collection - T1114</a> | <a href="https://ui.threatstream.com/ttp/947106">[MITRE ATT&CK] Spearphishing Link - T1192</a> | <a href="https://ui.threatstream.com/ttp/947205">[MITRE ATT&CK] User Execution - T1204</a> | <a href="https://ui.threatstream.com/ttp/2402630">[MITRE PRE-ATT&CK] Conduct social engineering - T1268</a> Tags: Microsoft Office 365, MFA Bypass, OAuth2, OIDC</div></div>