A newly discovered, widespread email phishing campaign hosted on Oracle Cloud and using Amazon Web Services (AWS) resources to steal Office 365 credentials from small and large businesses has been quietly operating in the U.S. and Australia for more than seven months, a new security report said.
The phishing emails are sent from legitimate but compromised Office 365 email accounts hijacked by an unidentified hacker, wrote Ofir Rozmann, a Mitiga threat intelligence and security expert, in a blog post. The phishing lures have targeted C-level executives at financial organizations and SMBs. “This email asks the targeted user to click a link for a voice mail message," Rozmann wrote. "Once the link was clicked, the user is redirected through several proxies, including AWS load balancers, all the way to a compromised website belonging to a genuine organization.”
Mitiga's analysis of the campaign began unexpectedly a few weeks ago when one of its employees received an email phishing for credentials.
Mitiga’s security team has rooted out roughly 40 websites belonging to SMBs that the threat actors have commandeered as part of their infrastructure proxy chain. The unsuspecting target ultimately lands on a fake Office 365 login page hosted on Oracle Cloud from which their credentials are exfiltrated to another hacked website. The AWS and Oracle infrastructure is controlled and operated directly by the threat actors, Rozmann said.
There are more serious ramifications of the scheme than stolen credentials. “It should go without saying that these compromised Office 365 credentials may be used as entry vectors for deeper access into the victim organization’s network, or used to conduct a Business Email Compromise (BEC) attack,” Roxmann wrote. "We have no indication that the phishing attempts targeting these email addresses were indeed successful, and that their credentials were in fact stolen. However, at least some email addresses were indeed compromised by the threat actor — the ones that were used to send the malicious emails."
The threat actors may have landed the phishing infrastructure from a phishing-as-a-platform service, based on Mitiga’s findings that suggest several subgroups have used the same infrastructure possibly procured from a central source. So far there’s no evidence that ties the campaign to a known cyber crime crew, Rosmann said.
Mitiga’s seven recommendations for organizations to safeguard against these attacks include:
