Spear-phishing attacks target United Nations and NGOs

Experts have uncovered an ongoing phishing campaign targeting the United Nations and NGOs, including UNICEF and UN World Food.

Security firm Lookout uncovered an ongoing spear-phishing campaign aimed at NGOs, including human rights organizations such as the Red Cross, UNICEF, the UN World Food and the UN Development programs.

The analysis of the server infrastructure behind the campaign shows that the attackers have to be active at least since March 2019. The company immediately reported his findings to targeted organizations and law enforcement agencies.

“Lookout Phishing AI has detected a mobile-aware phishing campaign targeting non-governmental organizations around the world, including a variety of United Nations humanitarian organizations, such as UNICEF.” reads the analysis published by the company. “The infrastructure connected to this attack has been live since March 2019. Two domains have been hosting phishing content, session-services[.]com and service-ssl-check[.]com, which resolved to two IPs over the course of this campaign: 111.90.142.105 and 111.90.142.91.”

The domains used in the campaign were not labeled as malicious by services like Google Safe Browsing.

Experts noticed that the threat actors employed several noteworthy techniques in this campaign, such as the ability to detect mobile devices and to log keystrokes.

Attackers deployed a Javascript code on the phishing pages that is able to determine if the user is accessing the page with a mobile device and delivers mobile specially-crafted content.

The experts also collected evidence of keylogging functionality embedded in the password field of the phishing login pages. After the victims provided their credentials to bogus Office 365 login forms, the sites display customized pages to show that the users successfully’ log into their accounts.

The sites used in the campaign use SSL certificates to appear as legitimate Microsoft Office 365 login pages.

“SSL certificates used by the phishing infrastructure had two main ranges of validity: May 5, 2019 to August 3, 2019, and June 5, 2019 to September 3, 2019. Currently six certificates are still valid, and Lookout suspects that these attacks may still be ongoing.” continues the analysis.

Experts pointed out that major browsers will alert users about the use of expired SSL certificates, this means that expired SSL certificates observed on some of the phishing sites can precious information on the campaign.

Below the list of certificates used in the spear-phishing attacks as part of this campaign:

Target Organization	URL	Live SSL Certificate
UN World Food Programme	fs.auth.wfp.org.adfs.ls.client-request-id.session-services.com	Valid until November 23
United Nations Development Programme	logon.undp.org.adfs.ls.client-request-id.session-services.com	Valid until November 18
United Nations	sso.united.un.org.adfs.ls.clinet-request-id.session-services.com	Valid until November 15
UNICEF	login.unicef.org.adfs.ls.client-request-id.session-services.com	Valid until November 16
Heritage Foundation	heritage.onelogin.com.login.service-ssl-check.com	Valid until November 18
International Federation of the Red Cross and Red Crescent Societies	sts.ifrc.org.adfs.ls.client-request-id.session-services.com	Valid until November 16
United States Institute of Peace	login.microsoftonline.com.common.oauth2.ip.session-services.com	Expired August 3
Concern Worldwide	login.microsoftonline.com.common.oauth2.co.session-services.com	Expired September 8
Humanity and Inclusion (French)	login.microsoftonline.com.common.oauth2.hi.session-services.com	Expired September 7
Social Science Research Council Sign-On Portal	sso.ssrc.org.adfs.ls.client-request-id.63f91e15.service-ssl-check.com	Expired September 3
UC San Diego	login.microsoftonline.com.common.oauth2.uc.session-services.com	Expired August 3
East-West Center	eastwestcenter.org.owa.auth.logon.aspx.replacecurrent.service-ssl-check.com	Expired September 3
Unknown/ Inaccessible	login.microsoftonline.com.common.oauth2.br.session-services.com	Expired August 3
Unknown/ Inaccessible	login.microsoftonline.com.common.oauth2.client.us.service-ssl-check.com	Expired September 3
Unknown/ Inaccessible	login.microsoftonline.com.common.oauth2.client.al.service-ssl-check.com	Expired September 3
Unknown/ Inaccessible	login.microsoftonline.com.common.oauth2.client.hi.service-ssl-check.com	Expired September 3
Yahoo (German)	login.yahoo.com.manage-account.src-ym.lang-en-us.session-services.com	Expired August 3
AOL (German)	login.aol.com.account.challenge.oauth.session-services.com	Expired August 3

At the time, it is not clear the motivation behind the spear-phishing campaign, both nation-state hackers and cybercriminals have targeted NGOs in the past for intelligence gathering or to conduct scams.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – iCloud, zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.