Gone are the days of tools such as link shorteners, IP geolocation utilities, and competitive intelligence being limited to marketers looking to optimize their marketing efforts.
Francis Scialabba
Link shorteners, IP geolocation utilities, and CAPTCHAs are among a few of the latest tools within the threat actor “playbook” for amplifying malicious campaigns.
Digital analytic and advertising tools are no longer limited to professionals in their respective industries. In a recent blog post, researchers from Mandiant and Google Cloud claimed that bad actors are weaponizing these innovative tools to add malicious data analytics—dubbed “malnalytics”—capabilities to their campaigns to expand their reach and evade detection by security tools.
Gone phishing. The researchers wrote that threat actors are using link-shortening services for purposes beyond beautifying a long link. Instead, attackers are using link shorteners to conceal the URL of malicious landing pages and redirect victims during the initial access phase of an attack chain. In one example provided, cyber espionage group MuddyWater used link shorteners to guide users to a phishing lure document hosted on a cloud storage provider in 2022.
DomainTools Product Marketing Manager Malachi Walker told IT Brew that he saw the tactic used throughout an Arc web browser launch campaign.
“I found a couple of them that are either spelled ‘ark windows’ or ‘aru windows,’ where it’s very close and if they have the right picture…[and] the right URL masked over it, you might not even notice it,” Walker said.
The researchers also noted that threat actors are using CAPTCHA services to bypass detonation processes that determine whether or not a URL is malicious. Attackers may send out phishing emails containing a link to a CAPTCHA screening domain that directs users to malicious content.
Upgraded gameplans. The researchers also stated that attackers are leveraging IP geopolitical utilities and competitive intelligence tools to aid in creating more strategic attacks. With access to services such as ip2location.io, an IP geolocation API lookup service, attackers can redirect a subset of users with specific connection types and locations to malicious web pages, while generating error codes for those using a VPN or The Onion Router (TOR).
They added that search engine marketing and competitive intelligence tools can aid bad actors in executing a malvertising campaign by granting them access to valuable information such as the success of victim flows from previous malvertising campaigns and characteristics of campaigns that have made it past moderation filters.
“It’s kind of like Pandora’s boxes have been opened and there’s a lot of access to tools that can make some really straight-level, low-line strategies a lot more sophisticated looking,” Walker said.
Gear up. Threat actors may have more tools at their disposal to craft targeted attacks, but all is not lost for defenders. The Mandiant and Google Cloud researchers suggested cybersecurity professionals adopt the following safeguards:
Walker added that one of the most important tasks for cybersecurity professionals looking to thwart these sorts of tricks is to remain aware of the latest threats.
“[I]t’s MuddyWater today, it’s something else tomorrow,” he said.
