Researchers discovered a phishing campaign which attackers designed to harvest login credentials from government procurement services. According to Anomali Labs, malicious actors crafted their campaign to target various services used by public and private entities to match buyers and sellers of government services. They did so by directing recipients of specially crafted phishing emails to view an attached lure document. Each of those lure documents incorporated the language of the country hosting a targeted government organization.They also included an embedded link that ultimately redirected recipients to the spoofed websites for various government agencies, email service providers and courier services. Researchers found that each of the fake websites contained a Domain Validation (DV) certification issued by "cPanel, Inc." and that their subdomains used a bidding theme to target organizations. As Anomali Labs described in its research:
In the webpages there are clear emblems and labels detailing which organisation the attacker is attempting to mimic. The attackers have used legitimate domains as well as their own infrastructure. The webpage for the U.S. Department of Energy was hosted on “https://energy.gov.secure.server-bidsync[.]best/auth/login.html” and redirected from the URL: “http://energy.gov.secure.bidsync.newnepaltreks[.]com”. The redirect URL is based on a legitimate domain “newnepaltreks[.]com” which is likely to have been compromised in order to facilitate this attack.
Credential harvesting sites observed in this campaign. (Source: Anomali Labs) Following its initial discovery of "server-bidsync[.]best," Anomali Labs identified a research hash that led it to unearth 14 other domains hosting similar phishing sites. It then used the naming conventions of those sites as pivot points to detect even more phishing resources. Researchers discovered a total of 62 domains and 122 phishing sites. Overall, the campaign spoofed more than 20 organizations including the U.S. Department of Energy, the U.S. Department of Commerce and the U.S. Department of Veteran Affairs. It targeted organizations in 12 countries including China, Sweden and South Africa. Even so, more than 50 sites specifically targeted organizations based in the United States. The motive behind this campaign remained unclear at the time of analysis. The phishing efforts described above highlight the need for government organizations and others to protect themselves against phishing campaigns. They can do so by educating their employees about some of the most common types of phishing attacks in circulation today.
