If the infamous bank robber, Willie Sutton, were alive today and honed his cyber skills, he might turn his attention to phishing and domain spoofing. Why? Because, as he once said about banks, “that’s where the money is.”

An IT manager of a multinational financial services (FinServ) holding company experienced this first-hand. He discovered malicious actors targeting his organization through a phishing site impersonating their brand and had the site taken down.

 

Catching Big Phish

Phishing sites are a common way for threat actors to harvest credentials and defraud customers. The barriers to entry for phishing have lowered even more now as attackers can purchase phishing toolkits and phishing pages on criminal forums and marketplaces.

Figure 1: Screen shot of criminal forum listing offering phishing pages for sale (Source: n0va[.]shop)

 

Posing as the official site of the financial institution, they trick users into entering credentials and other valuable information that they can sell on dark web marketplaces or online forums or use themselves to steal from customers or launch subsequent attacks. Whichever way the threat actor chooses to monetize that information, the FinServ institution can lose revenue and suffer reputational damage. Here’s how it works.

 

Figure 2: Screen shot from Digital Shadows SearchLight™ alert of site impersonating Digital Shadows’ website

 

The Hook, Line and Sinker of Domain Spoofing

Hook. Bad actors put significant effort into developing a façade that can fool the casual user. In this case they registered two domains and used typosquatting to make a small change in the URL, changing an “m” to an “rn”, and for the second domain added the suffix “finance”. The content on the landing page of the spoofed site was an exact mirror of the FinServ company’s site.

 

Line. With the site up and ready, the next step is to lure customers or staff to the sites. The threat actors used social engineering to tailor emails and make them as compelling as possible, so unsuspecting recipients would click on a link to the spoofed domain.

 

Sinker. To increase their return on investment, the attacker limited the actual functionality on the site to only what they needed to accomplish their mission. When the user input their username and credentials in the login box, they received an error and were asked to try again later. But the damage was done – the attacker had the credentials in hand to monetize in a variety of ways.

 

How did the IT manager learn their domain was being spoofed and what are they doing to keep it from happening again? See how Digital Shadows SearchLight™ enables organizations to detect and mitigate this type of risk: Test Drive SearchLight™ Free Here.

 

To learn more about identifying which cyber threats to prioritize, where to monitor for leaked intellectual property, and how to access hard-to-reach areas like the dark web, subscribe to our newsletter here.