BushidoUK

Keybase proof

I hereby claim:

• I am bushidouk on github.
• I am wthomas_cymru (https://keybase.io/wthomas_cymru) on keybase.
• I have a public key ASCsA6Hgrn9VCia0HWEn-zO_c-IUJp8sIlCXqki7zpqtawo

To claim this, I am signing this object:

BushidoUK

Fake Interviews Offered at Top Brands to harvest Gmail creds

• Phishing email sent posing as a recruiter looking to hire people for marketing roles
• The email addresses the individual by their name and the individual works in the relevant field, therefore the attackers likely did some relevant research and collection
• The target is then directed to click a link to book a meeting and is asked to provide their Gmail credentials

Phishing Workflow Summary

The attacker is using nested redirects across different legitimate platforms:

1. ⁠The email was sent via PeopleForce (peopleforce[.]io)⁠ a genuine, cloud-based Human Resource Management (HRM) and Applicant Tracking System (ATS) platform.

BushidoUK

1. https://www.team-cymru.com/post/an-introduction-to-operational-relay-box-orb-networks-unpatched-forgotten-and-obscured
2. https://www.team-cymru.com/post/botnet-7777-are-you-betting-on-a-compromised-router
3. https://www.team-cymru.com/post/uncovering-dprk-remote-workers
4. https://www.team-cymru.com/post/botnet-7777-are-you-betting-on-a-compromised-router
5. https://youtu.be/tbZWCT4h2jQ
6. https://www.kaspersky.co.uk/blog/turla-apt-exploiting-satellites/6210/
7. https://www.microsoft.com/en-us/security/blog/2024/12/04/frequent-freeloader-part-i-secret-blizzard-compromising-storm-0156-infrastructure-for-espionage/
8. https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/
9. https://cloud.google.com/blog/topics/threat-intelligence/turla-galaxy-opportunity/
10. https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims

BushidoUK

BSides London References

Team Cymru Community Services

• https://hash.cymru.com
• http://whois.cymru.com
• https://www.team-cymru.com/ddos-mitigation-utrs-services
• https://www.team-cymru.com/bogon-networks

Operation Endgame

• https://www.team-cymru.com/post/inside-danabots-infrastructure-in-support-of-operation-endgame-ii

BushidoUK

Regular_expression('User defined','.*bank.*',true,false,false,false,false,false,'List matches')
Regular_expression('User defined','.*, US.*',true,false,false,false,false,false,'List matches')
Find_/_Replace({'option':'Regex','string':'</a>'},'',true,false,true,false)
Find_/_Replace({'option':'Regex','string':'^.*>'},'',true,false,true,false) 

BushidoUK

Gmail phishing posing as Google Careers recruiter

IOCs

Email Sender:
reply-ff2913777d64-449_HTML-1463564-534018293-0[@]s12[.]y[.]mc[.]salesforce[.]com

Link Embedded in 'View the role' button in the Email body:
cl[.]s12[.]exct[.]net (13.110.204.9 - Salesforce ASN)

BushidoUK

Dubai Police Domains

dubai-police-ae-gonv[.]com
dubai-police-ae[.]com
dubai-police-gov[.]com
dubai-police-govn[.]com
dubai-police-uae[.]com
dubai-policeae-gov[.]com
dubai-policegovae[.]com
dubai-policegovr[.]com

BushidoUK

Summary

• Phishing campaign target Facebook accounts, as well as Threads and WhatsApp
• Emails sent using a recruitment platform called recruitee.com
• Landing pages are hosted with Cloudflare and target Facebook login credentials
• The websites are built with Socket.io

Example phishing email and sender

• application[@]realitylabshiring.recruitee.com

BushidoUK

Rules

WHAT'S REALLY GOING ON?

- We completed a security audit of your network, conducted a thorough investigation, downloaded all confidential, private, proprietary, legal, financial, compromising information of you, your customers and employees, including databases and all documents of value to you and your customers to show insecurity of your infrastructure. 
- Encrypted your data with a very strong AES+RSA algorithm, making it impossible to view or use by anyone but us. 
- Deleted all backups. 
- We have compiled a security report and are waiting for your payment for our services to recover and protect your sensitive information from exposure.

- How can I get my organization back to normal operations and avoid long-term losses due to sensitive data leakage and loss of access to encrypted files forever? 

BushidoUK

ossec-win32 used by Storm-0501
https://www.ossec.net/about/

OSQuery used by Storm-0501
https://www.osquery.io/

GitGuardian used by Scattered Spider*
https://www.gitguardian.com/

MAGNET RAM Capture used by Scattered Spider*