Rewterz Threat Advisory – Fortinet FortiOS SSL VPN portal cross-site scripting Vulnerability

Rewterz Threat Advisory – CVE-2020-8246 – Citrix Application Delivery Controller denial of service

September 21, 2020

Rewterz Threat Alert – Phishing Emails Targeting Banks in Pakistan

Severity

High

Analysis Summary

Our SOC analysts have discovered and analyzed a new phishing campaign targeting banks in Pakistan. These phishing emails successfully bypassed the email security controls and targeted multiple users in an enterprise environment. The email uses the subject Password Change Request Accepted, to create an urgency to trigger user response, as users will suspect that someone is attempting to change their password and would immediately take action. The sender’s email address is from the domain administrator[.]com which is detected as malicious on threat intel forums.

The email offers a Cancel Request button, which a user will click on, in order to prevent a password change attempt. Upon clicking the cancel request button, user will be redirected to a URL which is a fake login page for roundcube webmail service designed for credential harvesting. The website uses strict validations and has a SSL certificate as an advanced deception technique which tricks the users into believing that the page is secure and legitimate.

Once the user enters the credentials, they will be redirected to the same username domain. For example, if the user entered “User@rewterz.com” the user would be redirected to the rewterz mail domain. The embedded code is crafted in a way that it reads the email entered in the username field and parses its domain.

Impact

Credential Theft
Business Email Compromise

Indicators of Compromise

Email Subject

Password change request accepted

From Email

no-reply@administrator[.]com

URL

https[:]//output[.]jsbin[.]com/hodiqis

Remediation

Block the threat indicators at their respective controls.
If a security alert email looks very legitimate, do not respond to it without confirming legitimacy from network administrators.
Search for IoCs in your environment. Use the following detection technique to identify the possible threat on respective controls:

Sender contains : “no-reply[@]administrator[.]com” or “@administrator.com”
Subject contains : “Password change request accepted”
URL contains : “output.[your environment name]bin.com/hodiqis” for example : “output.rewterzbin.com/hodiqis”

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo