An in-depth look at Sniper Dz, a phishing-as-a-service platform that targets social media and online services, revealing its wide reach with over 140,000 phishing sites linked to it in the last year. The platform offers a free admin panel to generate pages, hosts content behind public proxies, and centralizes credential exfiltration and victim tracking. #SniperDz #Raviral
Keypoints
- Sniper Dz is a popular PhaaS platform with thousands of subscribers on Telegram.
- Over 140,000 phishing websites have been discovered associated with Sniper Dz in the past year.
- The platform offers an admin panel for phishers to generate and host phishing pages.
- Phishing pages can be hosted on Sniper Dz’s infrastructure or downloaded for self-hosting.
- Sniper Dz uses public proxy servers to hide phishing content and evade detection.
- Phishers can exploit legitimate SaaS platforms to host phishing pages, making detection harder.
- Stolen credentials are exfiltrated to a centralized infrastructure controlled by Sniper Dz.
MITRE Techniques
- [T1566] Phishing – Phishing attacks are facilitated through the Sniper Dz platform, which provides templates and hosting for phishing pages. ‘Phishing attacks are facilitated through the Sniper Dz platform, which provides templates and hosting for phishing pages.’
- [T1003] Credential Dumping – Stolen credentials are exfiltrated to a centralized endpoint controlled by Sniper Dz. ‘Stolen credentials are exfiltrated to a centralized endpoint controlled by Sniper Dz.’
- [T1027] Obfuscated Files or Information – Phishing template code is heavily obfuscated to evade detection. ‘Phishing template code is heavily obfuscated to evade detection.’
- [T1090] Use of External Proxy – Sniper Dz uses public proxy servers to hide the backend servers hosting phishing content. ‘Sniper Dz uses public proxy servers to hide the backend servers hosting phishing content.’
Indicators of Compromise
- [Domain] Sniperdz[.]com – Sniper Dz PhaaS Platform.
- [Proxy/Domain] proxymesh[.]com – Public proxy service used to hide phishing content.
- [Domain] raviral[.]com/k_fac.php – Centralized exfiltration endpoint.
- [URL] raviral[.]com/host_style/style/js-track/track.js – Embedded tracker script.
- [Telegram] t[.]me/JokerDzV2 – Telegram support channel.
- [Telegram] t[.]me/JokerDzV2/19 – Tutorial video link.
- [Domain] raviral[.]com – Redirection to Sniper Dz-owned websites.
- [Domain] 6627c220b5daa507c6cca1c5–votedme[.]netlify.app – Example phishing site.
- [Domain] automaticgiveaway[.]000webhostapp[.]com – Example phishing site.
- [Domain] Climbing-green-botany[.]glitch[.]me – Example phishing site.
- [Domain] facebookbusiness0078[.]blogspot[.]be – Blogspot hosting phishing pages.
Read more: https://unit42.paloaltonetworks.com/phishing-platform-sniper-dz-unique-tactics/