This article discusses leveraging Validin’s passive DNS history to enhance understanding of SCATTERED SPIDER phishing campaigns, particularly those linked to smishing attacks. By analyzing specific phishing domains and associated indicators, security analysts can obtain valuable insights to track malicious infrastructure effectively. Affected: SCATTERED SPIDER, Validin, cybersecurity sector
Keypoints :
- SCATTERED SPIDER, also known as 0ktapus, conducts phishing campaigns delivering smishing attacks.
- Researchers utilized Validin to expand insights gathered from a report on SCATTERED SPIDER.
- Nine phishing domains were identified as part of SCATTERED SPIDER’s campaigns.
- Validin’s bulk search capability allows for defanged domains to be analyzed for additional indicators.
- Malicious indicators were automatically marked in Maltrail as linked to SCATTERED SPIDER.
- The timeline view in Validin helps illustrate periods of distinct activity for phishing infrastructure.
- Further investigation yielded 13 additional domains related to the threat actor.
- Validin’s intuitive interface simplifies the process of utilizing passive DNS for threat detection.
- Suggested regex searches can help identify more potential phishing domains.
MITRE Techniques :
- T1071.001 – Application Layer Protocol: Use of smishing to deliver phishing pages mimicking SSO.
- T1484.001 – Domain Generation Algorithms: Identification of short-lived associations typically observed in SCATTERED SPIDER’s operations.
- T1562.001 – Impair Defenses: Misleading users into falling victim to phishing attacks by imitating legitimate services.
Indicator of Compromise :
- [Domain] okta-247[.]com
- [Domain] 247-inc.okta-247[.]com
- [Domain] login.okta-247[.]com
- [Domain] servicenow-hrblock[.]com
- [Domain] login.freshworks-hr[.]com
Full Story: https://www.validin.com/blog/coralling-scattered-spider-with-dns-history/