Espionage activities targeting European businesses

In the evolving landscape of cybersecurity threats, Fortgale is tracking PhishSurf Nebula, an advanced Cyber Espionage group active since 2021 and primarily targeting entities within the Banking & Finance and Real Estate sectors across Europe and North America.

In particular, most of the involved companies are Private Equity Firms, Hedge Funds, Venture Capitals and Luxury Real Estate Dealers.

PhishSurf Nebula (hereinafter PSN) has been demonstrated to possess advanced offensive capabilities, including the ability to bypass Multi-Factor Authentication (MFA) systems, a security measure employed by organizations to safeguard their employees from unauthorized access.

This article delves into the modus operandi and Tactics, Techniques and Procedures of PSN, highlighting aspects useful for Chief Information Security Officers (CISOs) and IT Departments in safeguarding their organizations and emphasizing the limitations of MFA when dealing with Advanced Cyber Attacks.

Attack Flow

1. PSN identifies potential targets of interest
2. A customized phishing website is built
3. The phishing campaign is developed specifically for the specific targets
4. Malicious emails, distributed in low volumes, are sent to victims
5. Clicking on the malicious links and login leads to the deployment of persistence mechanisms on the victim’s account (Office 365, Google Workspace)
6. Exfiltration, lateral movement, and privileges escalation activities are then carried on by the Threat Actor

How to Defend

1. Enhanced Security Measures: Given the persistent efficacy of PSN in circumventing MFA, CISOs and IT departments should contemplate the integration of supplementary security layers. This may encompass:
   • The adoption of Behavioral Analysis
   • The implementation of Identity Anomaly Detection activities
   • The deployment of Advanced Endpoint Protection mechanisms
2. Intelligence: Leverage Threat Intelligence feeds to ensure a proactive approach against evolving phishing techniques. Regular updates from these feeds facilitate staying ahead of the latest tactics employed by PSN and other threats
3. Continuous Monitoring and Adaptation: The evolving nature of PSN’s tactics necessitates ongoing vigilance and the adaptation of security strategies to counter new threats effectively. Participate in industry-specific information-sharing groups could be an effective strategy to stay informed about the latest attack trends
4. Employee Training and Awareness: Conduct routine phishing awareness training sessions for personnel, emphasizing the criticality of adeptly recognizing and promptly reporting phishing attempts to mitigate potential security breaches

Takeaways

A PSN breach could lead to severe C-Level accounts compromission having, as consequences, data exfiltration, financial losses and reputational damage.

Fortgale believes in an holistic approach that merges advanced cyber defense practices with leading cybersecurity technologies as an effective safeguard against sophisticated cyber threats like PSN.

Below is reported an in-depth analysis, with a complete overview of the attack patterns, Threat Actor, victims and campaigns.

In-Depth Analysis

PSN’s attack campaigns employ phishing emails as their attack vector to establish long-term access to victims’ account. These emails contain malicious attachments or links that redirect users to customized phishing websites.

PhishSurf Nebula’s attacks follow a standard infection process, which consists of mainly three steps:

Key aspects of the attack:

• The phishing email’s link employs OpenRedirect technique (CWE-601 URL Redirection to Untrusted Site ‘Open Redirect’)
• After clicking the link, the user is redirected to an intermediate legitimate website, compromised by the threat actor.
• The final landing page -shown above- is the one leveraging the PhishingKit.
• Different providers, in particular Office365, outlook. Exchange, Gmail, Webmail, are offered as login options, in order to maximize the surface of possible of victims.

Threat Actor

PhishSurf Nebula stands out due to its usage of a custom PhishingKit.

It seems that the Threat Actor abused of an open-source project called “Surf” (GitHub – headzoo/surf.) to execute Persistence activities on victims’ accounts.

The evidence surrounding this kit led Fortgale to designate the threat actor as “PhishSurf Nebula.”

The activities of the Threat Actor follow a cyclic rhythm, intensificating and reducing periodically.

Over the last nine months, Fortgale had gathered valuable information and insights:

Targets

PhishSurf targets strategic users mainly in the context of investments and real estate. The aim is probably to exfiltrate information related to assets, funds and acquisitions in order to sell them to relevant stakeholders.

At the same time, breached systems and companies can be used as vectors (Company A) to other potential victims (Company B) as explained above.

Victims are mainly US and Europe-based companies.

Fortgale has identified several targets in recent months through its Threat Intelligence activities. Some of these targets include:

Tactics and Recent Developments

The threat actor employs Digital Ocean to host fake login pages, creating multiple instances personalized with the target company’s name.

More than 300 unique IP Addresses have been collected, all having the same characteristics and interface.

The first sign of this strategy date back to 2021 and references have been seen until 4 months ago (August 2023).

After vanishing from Fortgale radars unexpectedly, PhishSurf Nebula has re-emerged in recent days.

Despite retaining its focus on targeting specific companies, PSN has made subtle changes to its infrastructure and tactics.

The latest insights reveal that the phishing kit is now hosted on “openresty” and exploits IPFS.io as a vector. IPFS, a modular suite of protocols, facilitates data organization and transfer through peer-to-peer networking.

Furthermore, PSN has adopted a new strategy of hosting media elements on a third-party website.

Similar Campaigns

Fortgale’s research revealed similar campaigns sharing tactics and infrastructure with the tracked threat. A Phishing landing page with a slightly different design was found – image below.

Further investigation uncovered common backend components, affirming a medium-confidence connection to PhishSurf Nebula.

Editor’s Notes

Similarities were founded between our analysis and the Intrusion Set described at: link.

We are currently not publicy relasing Indicators Of Compromise (IOCs) since they would expose the involved companies.

Contact us for further information: info@fortgale.com

Attack Patterns

Mapping of Tactics, Techniques and Procedures (TTPs) used by the Threat Actor.