DAN VASILE at BlueVoyant describes how phishing is evolving to become 2023’s primary cyber-security concern.
Phishing, in which a malicious actor uses social engineering and a persona to convince people to give up sensitive information, access, or money, has proven to be a powerful weapon in the cyber-criminal’s arsenal. As a result, there was a 61 per cent increase in the number of phishing attacks in the six months ending October 2022 compared to the 12 months before, totalling some 255 million worldwide throughout the year.
It may seem a simple tactic, but it is highly effective. Data shows that 30 per cent of phishing emails are opened by their intended victims. Furthermore, it is evolving; becoming more dynamic, harder to spot, and ultimately more effective. The use of redirections, Domain Name System (DNS) exploitation, and ‘smishing’ via a text message have all been key parts of this evolution.
Dynamic redirection
Delving deeper into these three tactics reveals why they have been added to attackers’ phishing toolkits. Dynamic redirection uses multiple redirections to ‘hop’ through different pages — steering potential victims to fake, malicious domains, while redirecting presumed threat hunters and phishing analysts to a useless error page, a seemingly benign google search, or to the official website. Our recent research highlights that these attacks increased by 150 per cent in 2021, and 240 per cent in 2022.
Another type of redirection aims to distribute the activity across several domains in the redirection chain to make detection harder by sending some victims to one domain, while the actual phishing content is in fact on a second domain in a list of search engine results.
To reach and therefore target the malicious page, a threat hunter will need to add another path segment each time. This redirection technique is highly effective in preventing cyber threat analysts from detecting the phishing content while displaying the malicious URL to the victims.
DNS exploitation
DNS translates human readable domain names (for example, www.something.com) to machine readable IP addresses (for example, 192.168.1.1). If a server receives a false translation, it stores this information for a certain period, and therefore can divert people to the incorrect address. The cache has therefore been ‘poisoned’.
A cyber-criminal only has to identify the DNS server’s software versioning and scan for vulnerabilities to check whether it uses Domain Name System Security Extensions (DNSSEC) or DNS encryption — and find access. As most DNS queries and responses are unprotected, it is sometimes possible for a malicious actor to redirect a server’s traffic to a site they control.
We have been tracking DNS-based phishing since 2021 and found that 67 per cent of all phishing attacks were hosted on dynamic DNS infrastructure. This demonstrates the easy wins this tactic can achieve for even a novice hacker, and all without having to register a domain.
Although malicious sites embedded into DNS infrastructure may only last a day or two before the cache resets, there can be thousands of new active subdomains a day. This makes it a low-cost, high-quantity, and highly adaptable phishing strategy for even low-skilled hackers.
To protect against large-volume phishing attacks, it is important to monitor for newly created subdomains daily. Quick detection and remediation are crucial to shutting down these attacks at the source.
Smishing
The third commonly used tactic is SMS phishing — or smishing. This aims to socially engineer a victim towards a malicious site or download via a text. The site in question is often only accessible via a mobile, making it harder to detect by threat hunters who may not be looking for mobile-only sites.
Hackers can use an automated tool to send SMS messages in bulk, with all-inclusive SMS gateway scripts available to purchase on the dark web. This means smishing requires very little technical know-how. These scripts only require the message, the sender’s number (can be through VoIP, such as Google Voice, for extra security), and a list of numbers to target.
Smishing often abuses legitimate third-party gateway APIs to deliver the text message, according to our threat intelligence. As these are inherently catered toward digital marketing and customer relationship management, they can make social engineering more persuasive.
This tactic is a symptom of a wider problem. To mitigate, it’s important to guide customers or employees to be vigilant and report each case. Ideally, suspicious phishing sites should be taken down before they reach the target via SMS. Therefore organisations need to make sure they are using an effective cyber-security tool to protect against brand impersonations before they are targeted with a text.
A word on Artificial Intelligence
The global arms AI race significantly impacts cyber security. ChatGPT and other similar text generation tools can empower social engineering and phishing in different languages and without tell-tale grammar mistakes or poor wording. More broadly, AI can effortlessly analyse a malicious campaign’s click and response rate, generate code for convincing web landing pages, or even produce fake invoices.
AI can, and should, be part of the solution. If used effectively by a cyber-security tool, it can more successfully detect the giveaway clues hidden in a phishing attack — whether that is the wording or timing of an email, or the internet pathway used by the criminal.
Protecting your organisation
To help stop this uptick in phishing attempts, organisations should consider ramping up digital risk management capabilities that can detect redirections and identify phishing domains. To protect against large-volume phishing attacks, it is important to maintain daily monitoring for newly created subdomain leveraging dynamic DNS infrastructure. Quick detection and remediation are crucial to shutting down these attacks at the source.
To mitigate the threat of smishing, it is important to guide your clients and employees to be vigilant and report cases. Smishing is a symptom and not the problem itself. The ideal is to have suspicious phishing sites taken down before they reach the target via SMS, so make sure you are well protected against brand impersonations.
- Vasile is Vice President, Strategic Advisory at BlueVoyant.
