Tag: domain impersonation

5 Attack Reports | 0 Vulnerabilities

Attack reports

Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66

In 2025, a significant surge in phishing attacks targeting major U.S. energy companies was observed. The campaign primarily focused on Chevron, ConocoPhillips, PBF Energy, and Phillips 66, utilizing sophisticated impersonation techniques. Attackers employed HTTrack-based cloning to replicate legiti…
phishing
rhadamanthys
credential harvesting
domain impersonation
investment scams
2025-09-12
energy sector
httrack
keitaro
website cloning
brand abuse
Published: September 12, 2025
Downloadable IOCs: 43

UAC-0057 Keeps Pressure on Ukraine and Poland

This report details recent cyber espionage campaigns targeting Ukraine and Poland, likely conducted by UAC-0057 (also known as UNC1151 or Ghostwriter). The threat actor used weaponized XLS spreadsheets with obfuscated VBA macros to drop first-stage DLL downloaders. C# and C++ downloaders were used …
cobalt strike
ukraine
cyber espionage
poland
vba macros
upx
confuserex
domain impersonation
downloaders
2025-08-27
Published: August 27, 2025
Linked vulnerabilities : CVE-2024-42009
Downloadable IOCs: 37

Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait

An ongoing phishing campaign targeting Kuwait's fisheries, telecommunications, and insurance sectors has been identified, utilizing over 100 domains for credential harvesting. The operation, observed since early 2025, employs cloned login portals and impersonated web pages. The infrastructure share…
phishing
credential harvesting
telecommunications
infrastructure
insurance
domain impersonation
ssh keys
2025-05-16
fisheries
kuwait
Published: May 16, 2025
Downloadable IOCs: 77

Threat Infrastructure Uncovered Before Activation

Between November 2024 and April 2025, a set of domains and servers impersonating an Iraqi academic organization and fictitious UK tech firms were tracked. The infrastructure, while dormant, exhibited characteristics similar to APT34 (OilRig), including shared SSH keys, structured websites, and deco…
oilrig
infrastructure
apt34
domain impersonation
2025-04-22
ssh keys
pre-operational staging
http decoys
m247
Published: April 22, 2025
Downloadable IOCs: 15

Scattered Spider: Still Hunting for Victims in 2025

Scattered Spider, a notorious hacking collective, continues to actively target victims in 2025. The group has expanded its focus to include services like Klaviyo, HubSpot, and Pure Storage, while targeting high-profile brands such as Audemars Piguet, Chick-fil-A, and Twitter/X. Silent Push research…
phishing
social engineering
hubspot
2025-04-09
domain impersonation
klaviyo
spectre rat
Published: April 9, 2025
Downloadable IOCs: 57
Click here to see more Attack Reports