Threat video1:00
Nyasher CloudFire MFA Proxy Phishing: Detection & IOCs
Nyasher relays Google passwords and MFA codes live through a reverse proxy. The page includes 9 detection rules, 19 IOCs and a free Splunk SPL rule.
Read the full threat intel for Nyasher CloudFire MFA Proxy Phishing: Detection & IOCs →
Chapters
- 0:00The hook68,676 calendar targets: live session hijacks.
- 0:04The storyCalendar invites lured victims to a live proxy.
- 0:10Attack pathCalendar invites lured victims through redirector links.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise13 indicators to hunt: 7 domains, 3 URLs and 3 SHA-256 hashes.
- 0:38MITRE ATT&CK techniques17 ATT&CK techniques, from resource development to command and control.
- 0:44Remediation4 steps now: Monitor Google Workspace audit logs for session-hijack evidence.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0068,676 calendar targets: live session hijacks.
0:05Calendar invites lured victims to a live proxy.
0:11Calendar invites lured victims through redirector links.
0:14A live proxy relayed every M-F-A.
0:17Sessions hijacked; mail and Drive exposed.
0:20Mailbox harvested; campaign detected and contained.
0:26No threat actor is attributed. Confidence: low.
0:3013 indicators to hunt: 7 domains, 3 URLs and 3 SHA-256 hashes.
0:3817 ATT&CK techniques, from resource development to command and control.
0:444 steps now: Monitor Google Workspace audit logs for session-hijack evidence.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.