Threat video1:00
Tech Support Scam Email Campaign: Detection & IOCs
Spoofed scam emails hit Japan at 13M+ volume, sending victims to fake alert pages; 9 detection rules, 24 IOCs and a free Splunk SPL rule.
Read the full threat intel for Tech Support Scam Email Campaign: Detection & IOCs →
Chapters
- 0:00The hookAbout 13.38 million scam emails.
- 0:04The storyFrom mid-December, operators shifted to mass email.
- 0:11Attack pathDisposable fake alert sites appeared.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise15 indicators to hunt: 2 domains, 12 phone numbers and 1 hosting.
- 0:38MITRE ATT&CK techniques10 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Block the 12 published scam phone numbers at the PBX/SBC.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 13.38 million scam emails.
0:05From mid-December, operators shifted to mass email.
0:08Links led to fake alert sites.
0:11Disposable fake alert sites appeared.
0:14More than 90% of senders were spoofed.
0:17Lures went mostly to Japanese addresses.
0:20Victims call the number on the page.
0:22They push remote access, then payment.
0:27No threat actor is attributed. Confidence: low.
0:3215 indicators to hunt: 2 domains, 12 phone numbers and 1 hosting.
0:3810 ATT&CK techniques, from resource development to impact.
0:434 steps now: Block the 12 published scam phone numbers at the PBX/SBC.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.