iiinova — where your digital self keeps evolving

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

Indicators of Compromise #IoC pweprarteasamesil[.]biz bldsosinveppaversnty[.]biz #cybersecurity #infosec

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

- Using phishing-resistant 2FA methods such as FIDO 2 security keys, passkeys, Windows Hello for Business etc. - Implementing e-mail filtering and analysis services, web filtering through proxy solutions. -Raising the awareness of employees for this attack vector through appropriate training.

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

Prevention The following measures can be used to detect or prevent this attack path: - Implementing Conditional Access for the M365 environment. Access is only granted after verification of certain connection or device details. Specific Microsoft licensing is required.

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

Additionally the account details should be checked for newly added, attacker-controlled authenticators that are used as a common persistence technique.

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

Remediation If faced with such an incident, the affected account should be secured ASAP. A mere password change is not sufficient to lock out the attackers. Rather, all user sessions and multifactor authentication sessions need to be revoked via Microsoft Entra ID or the M365 Admin Center.

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

After solving the Captcha the fourth and final stage of the attack chain is reached, in this case it is a Microsoft 365 Credential Phishing page capable of stealing the user's login, password and 2-Factor-Authentication code. With these credentials an attacker can gain a session token for this user.

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

The next stage of the attack acts as a filter for automated phishing analysis tools and web sandboxes by presenting the user with a Cloudflare Captcha challenge.

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

In the screenshot below you can see the form hosted on Microsoft Dynamics 365 with a very similar, simple lure that links to a third party site, in this case pweprarteasamesil[.]biz.

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

The campaign spreads through the email accounts of affected users, so the senders are usually known contacts from previous conversations. The subject uses this format: "<COMPANY NAME> Zahlung für 2. Quartal 06.05.2025". The lure in the e-mail leads to a form hosted on customervoice.microsoft.com

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 06/06/2025

🚨 🇩🇪 Fast spreading Multi-Factor-Authentication Phishing campaign We have observed multiple phishing incidents, primarily with German customers, that affect users enrolled with Multi-Factor Authentication. This type of an attack is also commonly referred to as Attacker-in-the-Middle (AitM) Phishing.

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 25/04/2025

DivXDownloadManager.dll = deb5bd989c9fdd5fe7f78f00a1216eb0 Heeschamjiet.rc = 2d4fdba00b7f7b02408a8ea6c199037e Shonomteak.bxi = e43ec4f0aa69a344fcb8431e60195f0f msvcp80.dll = 272a9e637adcaf30b34ea184f4852836 msvcr80.dll = 43143abb001d4211fab627c136124a44 8/8🧵

000 0

SECUINFRA Falcon Team @si-falconteam.bsky.social · 25/04/2025

Last but not least, here are some #IoC: URLs clients.contology[.]com/captcha/ koonenmagaziner[.]click/smash/clock gutenortherad[.]click/mountains/fairy Files crys.zip = 5d6be6cc3fb6f8c4c5d1b5f2eb399b74 Crysta_X64.exe = ff254c1778aefe5af06889f1f999dee3 7/8🧵

crys.zip

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 25/04/2025

The ZIP file contains an executable named "Crysta_X64.exe", along with three DLL files and two files with generated/randomized names and extensions. The DLL files are loaded by Crysta_X64.exe with "DivXDownloadManager.dll" being the probable sideloading payload. 5/8🧵

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 25/04/2025

From this second URL, another Powershell command is retrieved. Again, it uses Invoke-Webrequest, this time to download a ZIP file, which is dropped in the temporary directory and subsequently unpacked. 4/8🧵

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 25/04/2025

The powershell payload that the user is expected to paste into the Windows Run (Win+R) dialogue is copied to the clipboard automatically. It contains a Base64 encoded command, which calls Invoke-Webrequest to browse to a second, shortened URL. 3/8🧵

100 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 25/04/2025

The page source consists of heavily obfuscated javascript, utilizing different encoding tricks. When rendered in the browser or a web sandbox, the page content is decoded and the javascript sections are not immediately visible. 2/8🧵

110 1

SECUINFRA Falcon Team @si-falconteam.bsky.social · 25/04/2025

☑️#ClickFix / Fake Captchas posing as Cloudflare Verification pages We stumbled upon a web page that closely resembles Cloudfare's DoS Verification pages. Upon clicking the verification button, the familiar ClickFix verification dialogue is presented. 1/8🧵

120 2