Threat video1:00
Darcula V3 Utility Impostor Scams: Detection & IOCs
Darcula V3 clones any brand's site from a URL and pushes utility shutoff lures by text. Pair 9 detection rules and 20 IOCs with a free Splunk SPL rule.
Read the full threat intel for Darcula V3 Utility Impostor Scams: Detection & IOCs →
Chapters
- 0:00The hookDuke Energy logged more than 5,600 scam reports.
- 0:05The storyScammers clone a utility's site from a web address.
- 0:11Attack pathReportedly, scammers clone brands, register lookalike domains, buy ads.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise16 indicators to hunt: 3 IPs, 10 domains and 1 URL, and more.
- 0:38MITRE ATT&CK techniques10 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation4 steps now: Search your brand with 'customer service number' and 'pay my.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Duke Energy logged more than 5,600 scam reports.
0:05Scammers clone a utility's site from a web address.
0:08Shutoff threats demand payment.
0:11Reportedly, scammers clone brands, register lookalike domains, buy ads.
0:16Then shutoff-threat texts make victims click.
0:19A cloned site adds payment forms.
0:21Victims are pushed to prepaid cards or wire transfers.
0:27No threat actor is attributed. Confidence: low.
0:3216 indicators to hunt: 3 IPs, 10 domains and 1 URL, and more.
0:3910 ATT&CK techniques, from reconnaissance to impact.
0:444 steps now: Search your brand with 'customer service number' and 'pay my.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.