10-28-2020, 08:24 PM
Cyberattacks target international conference attendees
<div style="margin: 5px 5% 10px 5%;"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/cyberattacks-target-international-conference-attendees.png" width="622" height="315" title="" alt="" /></div><div><p>Today, we’re sharing that we have detected and worked to stop a series of cyberattacks from the threat actor Phosphorous masquerading as conference organizers to target more than 100 high-profile individuals. Phosphorus, an Iranian actor, has targeted with this scheme potential attendees of the upcoming Munich Security Conference and the Think 20 (T20) Summit in Saudi Arabia. The Munich Security Conference is the most important gathering on the topic of security for heads of state and other world leaders, and it has been held annually for nearly 60 years. Likewise, T20 is a highly visible event that shapes policy ideas for the G20 nations and informs their critical discussions.</p>
<p>Based on current analysis, we do not believe this activity is tied to the U.S. elections in any way.</p>
<p>The attackers have been sending possible attendees spoofed invitations by email. The emails use near-perfect English and were sent to former government officials, policy experts, academics and leaders from non-governmental organizations. Phosphorus helped assuage fears of travel during the Covid-19 pandemic by offering remote sessions.</p>
<p>We believe Phosphorus is engaging in these attacks for intelligence collection purposes. The attacks were successful in compromising several victims, including former ambassadors and other senior policy experts who help shape global agendas and foreign policies in their respective countries.</p>
<p><a href="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/cyberattacks-target-international-conference-attendees.png"><img loading="lazy" class="aligncenter wp-image-64177 size-full" src="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/cyberattacks-target-international-conference-attendees.png" alt=" Flow of a typical Phosphorus attack in this campaign" width="622" height="315"></a></p>
<p><em>Figure 1: Flow of a typical Phosphorus attack in this campaign</em></p>
<p>This activity was uncovered by Microsoft’s Threat Intelligence Information Center, or MSTIC, which tracks the world’s nation-state and cybercrime actors so we can better protect our customers. MSTIC is also critical to the work of our Defending Democracy Program, powering our <a href="https://www.microsoftaccountguard.com/en-us/">AccountGuard</a> threat notification service available in 30 countries worldwide and fueling the <a href="https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/">intelligence we share</a> to help keep elections secure. We build new protections into our products regularly based on the threats MSTIC uncovers.</p>
<p>We’ve already worked with conference organizers who have warned and will continue to warn their attendees, and we’re disclosing what we’ve seen so that everyone can remain vigilant to this approach being used in connection with other conferences or events.</p>
<p>We recommend people evaluate the authenticity of emails they receive about major conferences by ensuring that the sender address looks legitimate and that any embedded links redirect to the official conference domain. As always, enabling multi-factor authentication across both business and personal email accounts will successfully thwart most credential harvesting attacks like these. For anyone who suspects they may have been a victim of this campaign, we also encourage a close review of email-forwarding rules in accounts to identify and remove any suspicious rules that may have been set during a successful compromise.</p>
<p>We are also sharing the indicators of compromise (IOCs) observed during these activities. We encourage IT teams to implement detections and protections to identify possible prior campaigns and prevent future campaigns against their users. These indicators include phony email accounts and domains or websites used to steal victims’ credentials.</p>
<table width="0">
<tbody>
<tr>
<td width="239"><strong>INDICATOR </strong></td>
<td width="96"><strong>TYPE </strong></td>
<td width="335"><strong>DESCRIPTION </strong></td>
</tr>
<tr>
<td width="239">t20saudiarabia[@]outlook.sa<strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Think 20 (T20) conference</td>
</tr>
<tr>
<td width="239">t20saudiarabia[@]hotmail.com <strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Think 20 (T20) conference</td>
</tr>
<tr>
<td width="239">t20saudiarabia[@]gmail.com<strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Think 20 (T20) conference</td>
</tr>
<tr>
<td width="239">munichconference[@]outlook.com <strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Munich Security Conference</td>
</tr>
<tr>
<td width="239">munichconference[@]outlook.de <strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Munich Security Conference</td>
</tr>
<tr>
<td width="239">munichconference1962[@]gmail.com<strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Munich Security Conference</td>
</tr>
<tr>
<td width="239">de-ma[.]online</td>
<td width="96">Domain</td>
<td width="335">Domain used for credential harvesting</td>
</tr>
<tr>
<td width="239">g20saudi.000webhostapp[.]com</td>
<td width="96">Subdomain</td>
<td width="335">Subdomain used for credential harvesting</td>
</tr>
<tr>
<td width="239">ksat20.000webhostapp[.]com</td>
<td width="96">Subdomain</td>
<td width="335">Subdomain used for credential harvesting</td>
</tr>
</tbody>
</table>
<p>As we noted in our recent <a href="https://blogs.microsoft.com/on-the-issues/2020/09/29/microsoft-digital-defense-report-cyber-threats/">Digital Defense Report</a>, nation-state cyberattackers routinely pursue think tanks, policy organizations and governmental and non-governmental organizations, seeking information that an attacker can use for their benefit. We will continue to use a combination of technology, operations, legal action and policy to disrupt and deter malicious activity, but nothing replaces vigilance from people who are likely targets of these operations.</p>
<p class="tag-list">Tags: <a aria-label="See more stories about cyberattacks" href="https://blogs.microsoft.com/on-the-issues/tag/cyberattacks/" rel="tag">cyberattacks</a>, <a aria-label="See more stories about cybersecurity" href="https://blogs.microsoft.com/on-the-issues/tag/cybersecurity-2/" rel="tag">cybersecurity</a>, <a aria-label="See more stories about Defending Democracy Program" href="https://blogs.microsoft.com/on-the-issues/tag/defending-democracy-program/" rel="tag">Defending Democracy Program</a>, <a aria-label="See more stories about Microsoft AccountGuard" href="https://blogs.microsoft.com/on-the-issues/tag/microsoft-accountguard/" rel="tag">Microsoft AccountGuard</a>, <a aria-label="See more stories about Microsoft Threat Intelligence Center" href="https://blogs.microsoft.com/on-the-issues/tag/microsoft-threat-intelligence-center/" rel="tag">Microsoft Threat Intelligence Center</a>, <a aria-label="See more stories about MSTIC" href="https://blogs.microsoft.com/on-the-issues/tag/mstic/" rel="tag">MSTIC</a></p>
</div>
https://www.sickgaming.net/blog/2020/10/...attendees/
<div style="margin: 5px 5% 10px 5%;"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/cyberattacks-target-international-conference-attendees.png" width="622" height="315" title="" alt="" /></div><div><p>Today, we’re sharing that we have detected and worked to stop a series of cyberattacks from the threat actor Phosphorous masquerading as conference organizers to target more than 100 high-profile individuals. Phosphorus, an Iranian actor, has targeted with this scheme potential attendees of the upcoming Munich Security Conference and the Think 20 (T20) Summit in Saudi Arabia. The Munich Security Conference is the most important gathering on the topic of security for heads of state and other world leaders, and it has been held annually for nearly 60 years. Likewise, T20 is a highly visible event that shapes policy ideas for the G20 nations and informs their critical discussions.</p>
<p>Based on current analysis, we do not believe this activity is tied to the U.S. elections in any way.</p>
<p>The attackers have been sending possible attendees spoofed invitations by email. The emails use near-perfect English and were sent to former government officials, policy experts, academics and leaders from non-governmental organizations. Phosphorus helped assuage fears of travel during the Covid-19 pandemic by offering remote sessions.</p>
<p>We believe Phosphorus is engaging in these attacks for intelligence collection purposes. The attacks were successful in compromising several victims, including former ambassadors and other senior policy experts who help shape global agendas and foreign policies in their respective countries.</p>
<p><a href="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/cyberattacks-target-international-conference-attendees.png"><img loading="lazy" class="aligncenter wp-image-64177 size-full" src="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/cyberattacks-target-international-conference-attendees.png" alt=" Flow of a typical Phosphorus attack in this campaign" width="622" height="315"></a></p>
<p><em>Figure 1: Flow of a typical Phosphorus attack in this campaign</em></p>
<p>This activity was uncovered by Microsoft’s Threat Intelligence Information Center, or MSTIC, which tracks the world’s nation-state and cybercrime actors so we can better protect our customers. MSTIC is also critical to the work of our Defending Democracy Program, powering our <a href="https://www.microsoftaccountguard.com/en-us/">AccountGuard</a> threat notification service available in 30 countries worldwide and fueling the <a href="https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/">intelligence we share</a> to help keep elections secure. We build new protections into our products regularly based on the threats MSTIC uncovers.</p>
<p>We’ve already worked with conference organizers who have warned and will continue to warn their attendees, and we’re disclosing what we’ve seen so that everyone can remain vigilant to this approach being used in connection with other conferences or events.</p>
<p>We recommend people evaluate the authenticity of emails they receive about major conferences by ensuring that the sender address looks legitimate and that any embedded links redirect to the official conference domain. As always, enabling multi-factor authentication across both business and personal email accounts will successfully thwart most credential harvesting attacks like these. For anyone who suspects they may have been a victim of this campaign, we also encourage a close review of email-forwarding rules in accounts to identify and remove any suspicious rules that may have been set during a successful compromise.</p>
<p>We are also sharing the indicators of compromise (IOCs) observed during these activities. We encourage IT teams to implement detections and protections to identify possible prior campaigns and prevent future campaigns against their users. These indicators include phony email accounts and domains or websites used to steal victims’ credentials.</p>
<table width="0">
<tbody>
<tr>
<td width="239"><strong>INDICATOR </strong></td>
<td width="96"><strong>TYPE </strong></td>
<td width="335"><strong>DESCRIPTION </strong></td>
</tr>
<tr>
<td width="239">t20saudiarabia[@]outlook.sa<strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Think 20 (T20) conference</td>
</tr>
<tr>
<td width="239">t20saudiarabia[@]hotmail.com <strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Think 20 (T20) conference</td>
</tr>
<tr>
<td width="239">t20saudiarabia[@]gmail.com<strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Think 20 (T20) conference</td>
</tr>
<tr>
<td width="239">munichconference[@]outlook.com <strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Munich Security Conference</td>
</tr>
<tr>
<td width="239">munichconference[@]outlook.de <strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Munich Security Conference</td>
</tr>
<tr>
<td width="239">munichconference1962[@]gmail.com<strong> </strong></td>
<td width="96">Email</td>
<td width="335">Masquerading as the organizer of the Munich Security Conference</td>
</tr>
<tr>
<td width="239">de-ma[.]online</td>
<td width="96">Domain</td>
<td width="335">Domain used for credential harvesting</td>
</tr>
<tr>
<td width="239">g20saudi.000webhostapp[.]com</td>
<td width="96">Subdomain</td>
<td width="335">Subdomain used for credential harvesting</td>
</tr>
<tr>
<td width="239">ksat20.000webhostapp[.]com</td>
<td width="96">Subdomain</td>
<td width="335">Subdomain used for credential harvesting</td>
</tr>
</tbody>
</table>
<p>As we noted in our recent <a href="https://blogs.microsoft.com/on-the-issues/2020/09/29/microsoft-digital-defense-report-cyber-threats/">Digital Defense Report</a>, nation-state cyberattackers routinely pursue think tanks, policy organizations and governmental and non-governmental organizations, seeking information that an attacker can use for their benefit. We will continue to use a combination of technology, operations, legal action and policy to disrupt and deter malicious activity, but nothing replaces vigilance from people who are likely targets of these operations.</p>
<p class="tag-list">Tags: <a aria-label="See more stories about cyberattacks" href="https://blogs.microsoft.com/on-the-issues/tag/cyberattacks/" rel="tag">cyberattacks</a>, <a aria-label="See more stories about cybersecurity" href="https://blogs.microsoft.com/on-the-issues/tag/cybersecurity-2/" rel="tag">cybersecurity</a>, <a aria-label="See more stories about Defending Democracy Program" href="https://blogs.microsoft.com/on-the-issues/tag/defending-democracy-program/" rel="tag">Defending Democracy Program</a>, <a aria-label="See more stories about Microsoft AccountGuard" href="https://blogs.microsoft.com/on-the-issues/tag/microsoft-accountguard/" rel="tag">Microsoft AccountGuard</a>, <a aria-label="See more stories about Microsoft Threat Intelligence Center" href="https://blogs.microsoft.com/on-the-issues/tag/microsoft-threat-intelligence-center/" rel="tag">Microsoft Threat Intelligence Center</a>, <a aria-label="See more stories about MSTIC" href="https://blogs.microsoft.com/on-the-issues/tag/mstic/" rel="tag">MSTIC</a></p>
</div>
https://www.sickgaming.net/blog/2020/10/...attendees/