Project Hyphae

When Oktapuses Attack

Share This Post

Group-IB, a Singapore based security and threat research company, identified a multiphase smishing (I really hate that word) campaign complete with MFA capture. The campaign netted (see what I did there?) nearly 10,000 credentials spread across 130 organizations.  Based on their research, the companies targeted were primarily US based with a heavy emphasis on software development, telecommunications, business services, and financial organizations.  Some of the big-name companies which were confirmed compromised include Twilio, Cloudflare, Klaviyo, MailChimp, and Signal.  Based on the creation times of identified malicious domains, Group-IB demonstrates that the initial round of phishing appears to have started with the teleco providers, but also focused on organizations that could further provide opportunities for future supply chain attacks or confidential data that could be exfiltrated and sold.  Based on the technical report from Group-IB, one of the parties responsible is likely already known by law enforcement and may find himself in a holding tank soon (because phish). 


  1. Train your end users to be paranoid.

TLDR version:

Technical Report with IOCs:

Reach out to our incident response team for help

More To Explore

Information Security News 9-18-2023

Iranian Cyberspies Target Thousands of Organizations with Password Spray Attacks Article Link: Requests via Facebook Messenger Lead to Hijacked Business Accounts Article Link:

Information Security News 9-11-2023

University of Michigan Requires Password Resets After Cyberattack Article Link: Attackers Accessed UK Military Data Through High-Security Fencing Firm’s Windows 7 Rig Article Link:

Do You Want to Shore Up Your Defenses?

We're opening our first round of threat hunting engagements to 100 organizations. Sign up or join the wait list here.