Group-IB, a Singapore based security and threat research company, identified a multiphase smishing (I really hate that word) campaign complete with MFA capture. The campaign netted (see what I did there?) nearly 10,000 credentials spread across 130 organizations. Based on their research, the companies targeted were primarily US based with a heavy emphasis on software development, telecommunications, business services, and financial organizations. Some of the big-name companies which were confirmed compromised include Twilio, Cloudflare, Klaviyo, MailChimp, and Signal. Based on the creation times of identified malicious domains, Group-IB demonstrates that the initial round of phishing appears to have started with the teleco providers, but also focused on organizations that could further provide opportunities for future supply chain attacks or confidential data that could be exfiltrated and sold. Based on the technical report from Group-IB, one of the parties responsible is likely already known by law enforcement and may find himself in a holding tank soon (because phish).
Recommendations:
- Train your end users to be paranoid.
TLDR version: https://www.group-ib.com/media/0ktapus-campaign/
Technical Report with IOCs: https://blog.group-ib.com/0ktapus
