Silent Push Tracks a Mass Phishing Operation Through Fast Flux

MITRE Techniques

• [T1090.001 ] Proxy: Internal Proxy – Fast flux rotates victim connections through changing proxy infrastructure to hide the true hosting location (‘the technique of rapidly rotating a domain’s DNS records across many IP addresses and networks to avoid detection’).
• [T1568.001 ] Dynamic Resolution: Fast Flux DNS – The operation repeatedly changes DNS answers so the same domain resolves to different IPs over time (‘a single domain rotates across a constantly changing pool of IPs’).
• [T1036 ] Masquerading – Domains and pages impersonate legitimate brands and services such as banks, Canada Post, fraud teams, and security centers (‘bank look-alikes’, ‘pose as “fraud team,” “security centre,” and “live help” pages’).
• [T1566 ] Phishing – The infrastructure is used to lure victims into entering credentials and interacting with fake login or verification pages (‘phishing campaigns’, ‘full cloned login forms’).
• [T1056.001 ] Input Capture: Keylogging – The operator receives keystrokes before form submission, capturing victim input in real time (‘receives keystrokes before form submission’).
• [T1110 ] Brute Force – Stolen credentials are tested against the real bank in parallel to the phishing interaction (‘testing the stolen credentials against the real bank in parallel’).
• [T1204.001 ] User Execution: Malicious Link – Victims are directed to per-user entry URLs and lure pages via text-message-style phishing flows (‘links distributed by text message’, ‘single-use, per-victim entry URL’).
• [T1105 ] Ingress Tool Transfer – A Windows executable is delivered to the victim as part of the fake verification workflow (‘pushes a Windows executable’, ‘password-protected ZIP’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – The phishing kits and callback pages use web forms, live chat, and HTTP endpoints to collect and relay data (‘posts the victim’s username and password to a security.php endpoint’).