Threat video1:00
Bad Sushi Residential Proxy Phishing: Detection & IOCs
China-nexus phishers moved Japan and Taiwan lures onto residential proxies of 3.5 to 4 million IPs. Get 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for Bad Sushi Residential Proxy Phishing: Detection & IOCs →
Chapters
- 0:00The hookAbout four million residential proxies deployed.
- 0:04The storyIn April they moved from Telecom to residential proxies.
- 0:10Attack pathThey amassed four million proxies.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise5 indicators to hunt: 1 domain and 4 hostings.
- 0:37MITRE ATT&CK techniques10 ATT&CK techniques, from resource development to command and control.
- 0:42Remediation4 steps now: Reject SMTP connections whose HELO/EHLO is a non-existent, unresolvable.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About four million residential proxies deployed.
0:05In April they moved from Telecom to residential proxies.
0:10They amassed four million proxies.
0:13Redirectors fronted landing pages.
0:15Lures impersonated Japanese brands.
0:18Daily IP churn defeated detection.
0:21Emails delivered worldwide to targets.
0:23Recipients clicked links.
0:27No threat actor is attributed. Confidence: low.
0:325 indicators to hunt: 1 domain and 4 hostings.
0:3710 ATT&CK techniques, from resource development to command and control.
0:424 steps now: Reject SMTP connections whose HELO/EHLO is a non-existent, unresolvable.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.