Threat video1:00
Black Friday Phishing Quishing and BEC: Detection & IOCs
AI-polished QR, callback and PayPal lures target staff before Black Friday. 9 detection rules, 30 IOCs and a free Splunk SPL rule.
Read the full threat intel for Black Friday Phishing Quishing and BEC: Detection & IOCs →
Chapters
- 0:00The hookEnterprise email phishing campaign: 29 indicators.
- 0:04The storyOkta Threat Intelligence tracks the O-UNC-037 employee-benefits campaign.
- 0:15Attack pathRegister lookalike and redirector domains.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise29 indicators to hunt: 29 domains.
- 0:37MITRE ATT&CK techniques19 ATT&CK techniques, from reconnaissance to impact.
- 0:41Remediation5 steps now: Require out-of-band verification for payment-change, ACH, gift-card and direct-deposit requests.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Enterprise email phishing campaign: 29 indicators.
0:05Okta Threat Intelligence tracks the O-UNC-037 employee-benefits campaign.
0:11PayPal stated it was actively mitigating.
0:15Register lookalike and redirector domains.
0:18Stand up sending accounts and relays.
0:20Send themed lures to employees.
0:27No threat actor is attributed. Confidence: low.
0:3229 indicators to hunt: 29 domains.
0:3719 ATT&CK techniques, from reconnaissance to impact.
0:425 steps now: Require out-of-band verification for payment-change, ACH, gift-card and direct-deposit requests.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.