Pierluigi Paganini October 25, 2019

Experts have uncovered an ongoing phishing campaign targeting the United Nations and NGOs, including UNICEF and UN World Food.

Security firm Lookout uncovered an ongoing spear-phishing campaign aimed at NGOs, including human rights organizations such as the Red Cross, UNICEF, the UN World Food and the UN Development programs.

The analysis of the server infrastructure behind the campaign shows that the attackers have to be active at least since March 2019. The company immediately reported his findings to targeted organizations and law enforcement agencies.

“Lookout Phishing AI has detected a mobile-aware phishing campaign targeting non-governmental organizations around the world, including a variety of United Nations humanitarian organizations, such as UNICEF.” reads the analysis published by the company. “The infrastructure connected to this attack has been live since March 2019. Two domains have been hosting phishing content, session-services[.]com and service-ssl-check[.]com, which resolved to two IPs over the course of this campaign: 111.90.142.105 and 111.90.142.91.”

The domains used in the campaign were not labeled as malicious by services like Google Safe Browsing.

Experts noticed that the threat actors employed several noteworthy techniques in this campaign, such as the ability to detect mobile devices and to log keystrokes.

Attackers deployed a Javascript code on the phishing pages that is able to determine if the user is accessing the page with a mobile device and delivers mobile specially-crafted content.

The experts also collected evidence of keylogging functionality embedded in the password field of the phishing login pages. After the victims provided their credentials to bogus Office 365 login forms, the sites display customized pages to show that the users successfully’ log into their accounts.

The sites used in the campaign use SSL certificates to appear as legitimate Microsoft Office 365 login pages.

“SSL certificates used by the phishing infrastructure had two main ranges of validity: May 5, 2019 to August 3, 2019, and June 5, 2019 to September 3, 2019. Currently six certificates are still valid, and Lookout suspects that these attacks may still be ongoing.” continues the analysis.

Experts pointed out that major browsers will alert users about the use of expired SSL certificates, this means that expired SSL certificates observed on some of the phishing sites can precious information on the campaign.

Below the list of certificates used in the spear-phishing attacks as part of this campaign:

At the time, it is not clear the motivation behind the spear-phishing campaign, both nation-state hackers and cybercriminals have targeted NGOs in the past for intelligence gathering or to conduct scams.

Pierluigi Paganini

(SecurityAffairs – iCloud, zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]