{"id":29374,"date":"2019-10-14T11:21:14","date_gmt":"2019-10-14T10:21:14","guid":{"rendered":"https:\/\/www.intelligentcio.com\/africa\/?p=29374"},"modified":"2019-10-18T10:22:54","modified_gmt":"2019-10-18T09:22:54","slug":"south-africa-among-top-20-countries-targeted-in-new-phishing-influx","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/africa\/2019\/10\/14\/south-africa-among-top-20-countries-targeted-in-new-phishing-influx\/","title":{"rendered":"South Africa among top 20 countries targeted in new phishing influx"},"content":{"rendered":"\n<p>Fortinet researchers studying\nphishing domains have found that South Africa was among the top 20 countries\ntargeted in a large influx of recent phishing attacks.&nbsp;<\/p>\n\n\n\n<p>FortiGuard Labs observed a large influx of phishing domains being registered in batches by a phishing threat actor or group.&nbsp;<\/p>\n\n\n\n<p>They immediately\nlaunched an investigation to uncover additional indicators of compromise (IOCs)\nrelated to this campaign. Because of some careless behaviours that &#8211; if avoided\n&#8211; could have masked their behaviour, they were able to learn the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The phisher(s) abused a specific OVH (online virtual hosting) registrar in order to bulk register domain<\/li><li>They managed to register over 200 domains every day for over a week<\/li><li>Phishing domains were delivered to victims through phishing emails sent to more than 100 countries<\/li><li>Many of the registrant emails used the following pattern: &lt;random_string&gt;@e.o-w-o[.]info<\/li><li>To support the backend, the Phisher(s) had registered and consistently used the same group of dedicated name servers<\/li><\/ul>\n\n\n\n<p>The researchers started\nwith known phishing domains, finding registrants and name servers, and then\niteratively expanded the search to bring in more related IOCs. After the\nexpansion of some malicious seeds, they were then able to blacklist about 3000 phishing\nIOCs.<\/p>\n\n\n\n<p>Fortinet\u2019s telemetry\ndata revealed that the campaign targeted over 100 countries, with the highest\nnumber of visits \u2013 2,111 \u2013 to the U.S. Also in the top five were China, Mexico,\nVietnam and Kazakhstan. South Africa \u2013 with 167 visits \u2013 was number 17 in the\ntop 20 countries targeted, followed by Thailand, Singapore and Italy.<\/p>\n\n\n\n<p>This campaign stands out\nbecause the threat actor continually registered new domains and hosted their\nown dedicated DNS servers. As a result, Fortinet was able to monitor their\ncampaign closely and can similarly monitor other phishing threat actors as long\nas they consistently used a dedicated infrastructure (IP address, Name Server,\nor WHOIS registrants), or used some unique URL patterns in their phishing\nsites.<\/p>\n\n\n\n<p>Because many phishers\nare similarly careless, this monitoring technique can be re-used to find more\nphishers. For example, Fortinet was able to use this same strategy to catch the\nMicrosoft Fake AntiVirus Group. This group has the following characteristics:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>They register their attacks using free domains, such as .tk, .ml, and\n.ga, etc. Fortinet has observed them registering over 100 new domains daily<\/li><li>They always use name servers hosted by Freenom (ns02[.]freenom[.]com)<\/li><li>Host domains always use the same set of dedicated IP addresses<\/li><\/ul>\n\n\n\n<p>Fortinet has been able\nto catch this group by monitoring their dedicated IP addresses.<\/p>\n\n\n\n<p>Doros Hadjizenonos, Regional Sales Director\nat Fortinet, said: \u201cCybercriminals tend to do the\nsame things over and over again. Our recent <em>Fortinet Threat Landscape Report<\/em> for\nQ1 of 2019 showed that a surprising number of attackers use the exact same\nweb-based infrastructure and leverage those resources at the exact same step on\ntheir attack cycle. Learn those patterns and you can begin to see and even\nanticipate an attack before it is even launched.\u201d<\/p>\n\n\n\n<p>However, not every cybercriminal\nis careless. Fortinet says phishing sites are usually hosted on compromised\nwebsites. As a result, the threat actor\u2019s behaviour is easily concealed. Other\nmethods for obscuring phishing activities often include:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Using compromised websites to host phishing sites&nbsp;<\/li><li>Using free hosting websites<\/li><li>Abusing free Microsoft web services<\/li><li>Using shared web hosting services, and shared name server services<\/li><\/ul>\n\n\n\n<p>\u201cThe best approach to\ncountering Phishing attacks is to regularly train all personnel to be wary of unknown\nsenders and to not click on links\/attachments of suspicious emails,\u201d said Hadjizenonos.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Fortinet researchers studying phishing domains have found that South Africa was among the top 20 countries targeted in a large influx of recent phishing attacks.&nbsp; FortiGuard Labs observed a large influx of phishing domains being registered in batches by a phishing threat actor or group.&nbsp; They immediately launched an investigation to uncover additional indicators of [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":29375,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,275,19,54,9059,13,262],"tags":[2525,160,332,7449,35,1575,7927,11336,5720,11334,10407,11339,11337,11331,11332,453,11335,11333,6871],"class_list":["post-29374","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-intelligent-technology-newsletter","category-regional-news","category-research","category-south-africa","category-top-stories","category-used","tag-china","tag-dns","tag-doros-hadjizenonos","tag-fortiguard-labs","tag-fortinet","tag-fortinet-threat-landscape-report","tag-ioc","tag-ip-address","tag-italy","tag-kazakhstan","tag-mexico","tag-microsoft-fake-antivirus-group","tag-name-server","tag-online-virtual-hosting","tag-ovh","tag-south-africa","tag-thailand","tag-u-s","tag-url"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=29374"}],"version-history":[{"count":4,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29374\/revisions"}],"predecessor-version":[{"id":29577,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29374\/revisions\/29577"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/29375"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=29374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=29374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=29374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}