3 Lesser-Known but Common Phishing Techniques & Steps for Mitigation

This week’s blog is all about phishing. With any luck, I won’t need to make you aware of what phishing is, but in case you need a recap, check out our previous phishing blogs; The Ecosystem Of Phishing: From Minnows To Marlins and The Phight Against Phishing. So why am I writing this blog? To shed light on some of the lesser-known tactics used in phishing campaigns. I’ve picked these because even as a seasoned cyber analyst, they’re still a little mysterious to me. And hopefully, knowing more about the different tactics cybercriminals use will make you better equipped to Fight the Phish!

An email hijacking

Phishing remains one of the most popular initial access methods for cyber threat actors. In the UK, around half of all cyber attacks involve phishing. The success of phishing attacks relies on social engineering – exploiting the weak link in the defensive chain.

The typical phishing email will attempt to spoof a legitimate sender, tricking the recipient into thinking the threat actor behind the email is someone they are not. However, more sophisticated campaigns have been known to hijack legitimate email chains, inserting a phishing email into an ongoing conversation.

These attacks, known as email hijacking, will almost always start with the takeover of a victim’s email account, whether by credential theft and reuse or by brute force. Once in control of a victim’s email account, threat actors can monitor conversations and identify the ideal opportunity to insert a malicious email into an existing thread. By having the whole email thread available to them, threat actors can tailor their malicious emails to suit any context. While this is arguably more labor-intensive for a threat actor, it yields higher rewards too. This tactic exploits the trust that has already been established between the two parties in the email exchange and increases the chances that the recipient will open a malicious attachment or click a bad link. If we’ve been discussing cute puppies for the last three days, why wouldn’t I click the link you sent me to see more cute puppies?!

But, how do the threat actors stop the actual account owner from getting suspicious when they get a “reply” to an email they never sent? Attackers route the email replies to a folder that the true owner would never usually go into. Gmail users, have you ever looked in the “snoozed” folder? Or attackers could set up auto-forward rules to send the email to a different inbox entirely. Threat actors can also create auto-detection rules for phrases like “phish” or “hack.” So even if someone tries to alert you to a potential compromise on your email, the message gets automatically deleted. So many ways for threat actors to stop anyone’s Spidey senses from spiking.

 

These hijacked emails are often difficult to spot. The usual warning signs—bad spelling, bad grammar, no personalization—aren’t there. This tactic has been used during the delivery of malware such as “Emotet” and “Ursnif” successfully in the past. Proof of the need to be extra diligent when something seems slightly out of the ordinary. And definitely, check large financial transactions through a different communication method before hitting the giant red send button with the bank.

Out-of-office alert!

This next tactic seems so obvious but had never really crossed my mind until relatively recently in my cyber lifetime. I figure there must be other people in the same boat as me, so let’s look now at why cyber threat actors might collect your out-of-office reply.

We all know how good it feels to set your out-of-office auto-reply ahead of your big vacation. But, that out-of-office does more than make your colleagues jealous. It also lets an attacker know that the email address is valid. Typical phishing campaigns take a scatter-gun approach. The threat actor will send the same email to hundreds, or thousands, of email addresses and hope for some interaction. The receipt of an out-of-office gives a threat actor a good starting point. Threat actors could apply this scatter-gun approach to everyone in your organization and collect the automatic replies they receive. Depending on the information contained within those replies, a threat actor could start to piece together who works with who, who’s more important, and most importantly, who isn’t in the office when their campaign commences.

What information do you typically include in your out-of-office reply? Where you are? How long you’ll be gone? Who to contact in your absence? Is this starting to sound familiar? An out-of-office reply can provide a wealth of information for any threat actor. Your email signature tells an attacker your role, department, and even your phone number. Your alternative contact tells an attacker who you work closely with and, potentially, their email address. If you’re an over-sharer, your automatic reply might even say to a threat actor where in the world you are and how long you’re going to be away from the office. 

This information helps a threat actor create a more tailored phishing email and increases their chances of receiving positive interaction with that email. The people you list as a contact on your automatic reply will be expecting emails meant for you and, therefore, might be more trusting of a cold approach from a threat actor pretending to be one of your clients. Couple that with information about how much “you” are enjoying your holiday in, let’s say, Antigua, then their success rates are likely to skyrocket. 

My advice? If you don’t typically work with external clients or vendors, then set your out-of-office reply to internal recipients only. Or ditch the email reply entirely. You could use your company’s instant messaging platform or your group calendar to let your colleagues know that you’re off on your hols. If your out-of-office reply must be external, then be sure to remove as much information from it as possible. As much as you can get away with.

Infrastructure theft

The last tactic to highlight in this blog is how threat actors use stolen infrastructure to progress their phishing campaigns. This isn’t exclusive to “phishers” but is a popular tactic nonetheless. Be sure to check out our Domain Monitoring blog if this kind of thing floats your boat!

While not exactly stealing infrastructure, typo-squatting does steal an organization’s brand and reputation to further a cyber threat campaign. Typo-squatting is when threat actors register domains with deliberately misspelled names of well-known websites. The changes can be very subtle; they can trick even the savviest internet users. For example:

• Typo-squatted domain: digitaIshadows[.]com (Do not visit this site)
• Legitimate domain: digitalshadows[.]com (Visit this one)

Can you spot the difference? Threat actors use this tactic to lure unsuspecting visitors to alternative websites that they think are safe. However, visitors are actually visiting attacker-controlled infrastructure. 

Now onto when threat actors steal the legitimate infrastructure used by unsuspecting organizations. There are two main ways for threat actors to do this. First, they could compromise a registrar. When a registrar is hacked, all domains registered using that registrar are at the disposal of the threat actor. They might use this control to point the domain to their infrastructure: An unsuspecting website visitor would type the legitimate domain name into their browser, but upon hitting enter, the visitor ends up on attacker-controlled infrastructure rather than the original domain. Alternatively, threat actors could transfer the ownership of a domain entirely, leaving no need for re-directs. Since there is a delay in updating DNS, it can be several hours before anyone notices something is wrong. 

The other tactic that threat actors can use is known as domain hijacking. This involves a threat actor gaining unauthorized access to an organization’s domain. Access may be achieved through credential stuffing or exploiting an XSS vulnerability in the website. The threat actor may take the domain offline or transfer the ownership to themselves. Again, any legitimate visitor to this domain won’t know that it is now under the control of a threat actor and will trust the, now malicious, links contained within. Domain hijacking might also be used to gather the information of these visitors; they may need to log in to view portions of the website or enter their personal information to update their contact preferences. This tactic can also be used to extort money from the actual domain owners, but that’s a whole different blog!

Phishing mitigation advice and conclusion

What these tactics have in common is that they are all designed to lure unsuspecting Internet users into interacting with a phishing email or website. Threat actors are continually evolving and improving their tactics, techniques, and procedures, coming up with more crafty ways to trick their victims. To mitigate against phishing attempts, we recommend the following tips:

1. Limit the information your organization and employees share online, including on social media sites. The most successful phishers perform detailed reconnaissance to craft the most effective emails and social engineering lures.
2. Monitor for registrations of typo-squatted domains that attackers can use to impersonate your brand, send spoofed emails, and host phishing pages.
3. Implement additional security measures, such as Sender Policy Framework (SPF), Domain Message Authentication Reporting and Conformance (DMARC), and DomainKeys Identified Mail (DKIM). These can make the spoofing of your domain more difficult. Check out our detailed practitioner’s guide to combating email spoofing risks.
4. Protect your accounts in case phishers do manage to steal user credentials. Two-factor authentication measures should be mandated across the organization and implemented whenever possible.
5. Train your employees to spot phishing emails and, more importantly, give them a clear and recognized reporting method to alert security teams of suspected phishing attempts. Eventually, a phishing email will fall through the net. Employees need to know how to react to these quickly and should not fear any repercussions of being the victim of a social engineering attack.

If you’re curious about how Search Light’s (now ReliaQuest GreyMatter Digital Risk Protection) threat intelligence can help protect you from phishing, why not sign up for a demo.