Threat video1:00
Fake Takedown Bank Phishing Kit: Detection & IOCs
A phishing kit shows returning visitors a fake suspension page so live bank clones look dead. Includes 9 detection rules (a free Splunk SPL one) and 9 IOCs.
Read the full threat intel for Fake Takedown Bank Phishing Kit: Detection & IOCs →
Chapters
- 0:00The hookCampaign impersonates 300 banks, fakes suspension since May.
- 0:05The storyStarting May, the campaign impersonated US banks.
- 0:13Attack pathAccording to Kela, they registered look-alike domains and deployed a kit.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise5 indicators to hunt: 4 domains and 1 hosting.
- 0:38MITRE ATT&CK techniques8 ATT&CK techniques, from reconnaissance to lateral movement.
- 0:43Remediation4 steps now: Block and sinkhole the published look-alike domains at DNS.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Campaign impersonates 300 banks, fakes suspension since May.
0:05Starting May, the campaign impersonated US banks.
0:09Repeat visitors saw fake suspension screens.
0:13According to Kela, they registered look-alike domains and deployed a kit.
0:17First-time visitors got a bank login form.
0:20Those who returned got a fake suspension notice to evade takedown vendors.
0:28No threat actor is attributed. Confidence: low.
0:335 indicators to hunt: 4 domains and 1 hosting.
0:388 ATT&CK techniques, from reconnaissance to lateral movement.
0:434 steps now: Block and sinkhole the published look-alike domains at DNS.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.