Rewterz Threat Alert – Cyber Actors Exploit Website Secure Certificates in Phishing Campaigns

Severity

Medium

Analysis Summary

Cyber threat actors are maliciously registering and hosting their HTTPS phishing sites with legitimate domain providing companies. This tactic is alarming because it exploits the trust of users in websites that display HTTPS certificates for the domain provider.

The HTTPS phishing campaigns continue to facilitate all types of malware delivery by cyber threat actors because victims easily trust the HTTPS certificates and click on malicious links without suspecting.

As this attack vector continues to be successful, it may result in loss or exposure of sensitive data or the destruction of IT infrastructure, leading to further exploitation and data breach.

The HTTPS phishing campaigns target financial institutions, social media platforms, Internet service providers, courier delivery services, cloud storage, web email, online data storage, online shopping services, media service providers, and online dating sites.

Impact

Malware Infection

Credential Theft

System Access

Information Disclosure

Remediation

Observe the following mitigation techniques to reduce the likelihood of successful HTTPS phishing attacks:

• Deploy Application Whitelisting (AWL) to prevent unauthorized software from executing.
• Deploy a trusted well-configured Anti-Exploitation mitigation toolkit.
• Inspect outbound URLs, the organization’s firewall, HIPS, and security content to detect malicious domains, IP addresses beaconing, etc.
• Use inbound email sandboxing (detonation chambers and URL scanners) on the mail server.
• Strictly limit admin privileges to administrators only which must not be used for personal online activities.
• Inspect and decrypt traffic on a regular basis in order to catch malicious actors before they take advantage of encrypted systems.
• Deploy HTTPS inspection products which verify the product contains properly validated certificate chains and passes any warnings or errors to the client.
• Use best practice methods to determine if preferred HTTPS inspection products properly validates certificates and prevents connections to sites using weak cryptography.
• Implement and conduct regular organizational security awareness related to social engineering involving phishing campaigns.