welcome to my presentation about fish
like an apt with the slogan phenomenal
pretext thing for persuasive fishing
in the next 30 minutes i'm going to
pitch why we need to think about what we
send in a fishing meal during adversary
simulation
um so first who am i
uh my name is sola masochist and i'm
from the netherlands uh i think that's
why my last name is so hard to pronounce
i guess
and i work in the red team and in the
research and infusion team so that means
i do red teaming but also advise
companies about threat intel and write
strategic reports
if i have to think about two things in
my career
in the apt or fishing field i think i
have two things i'm really proud of and
first one is that i once successfully
fished the white team so during a red
team we have we had to fish a couple of
people and i also sent one of the
messages to one person of the white team
so they know what we were doing and that
person well
that person knew that we were going to
send a fishing mail but still thought
this was a real and a legit one instead
of the fishing mill we were about to
send for uh for the for the simulation
so that's really nice i guess and the
second one is that i was the apg during
the biggest cyber crisis exercise
it was last june and i had to create an
attack for the well-known
country raspberry in the middle east so
i had to make up the ttps myself and
have had to create an attack um
targeting all governmental and vital
organizations of the netherlands so that
was really nice normally you do red
teaming for one company and now it was
96 though it was really a milestone in
my career so far
so fishing during adversary simulation
um well we know that fishing is a
commonly used technique to get initial
access research showed that i think
around 90 percent of attacks start with
uh with a phishing email with uh well a
weaponized um
document for example so if we look at
the mitre tech framework we see that uh
they have defined technique
t-1566 which is fishing and has three
slip techniques so the three sub
techniques are the spear fishing
attachment
so it's a fishing meal with
an attachment like a maldoc for example
or
archive um which is malicious so you
send an email to the victim add an
attachment that a victim opens the
attachments executes it and
then you infected the victim
the next one is the spear phishing link
so the email includes a link maybe to a
phishing website maybe for credential
harvesting login
page
also could be a link to a known
known surface for example so you um
[Music]
you
host
your malicious document
for example on google drive or dropbox
and the last one is spare phishing vs
surface and
i think you see that sometimes that um
attackers don't use email for delivering
your payload or for your weapon
delivering your weapon but also services
like
linkedin twitter
or telegram
and why do we do that why
why do attackers steal fish because it
just works every time um
well people still click on it it has a
great return on investment so why would
you not send as a spear phishing email
to to target an organization because
we
as humans
get a lot of email every day and we have
to decide every time whether it's a
legit email or a phishing email and we
have to decide in a split second and in
that split second
we have to check if it matches
everything we got your security
awareness training
so why do people click actually is
because we don't know
what a legit email or a phishing meal is
so we didn't get security awareness
trainings
um well that's really bad i think
everyone
must have a basic knowledge about
phishing emails um but yeah if you don't
know what a phishing email is or a legit
email you cannot distinguish them from
each other
well that's really bad and you don't
know
how to process that email the second one
it was is because the email is more
advanced than the
awareness training conference so what i
see is that training uh in security
awareness is sometimes really outdated
but also sometimes uh email is just way
more advanced and very very hard to
distinguish from um
yeah from a legit uh legit one um so
yeah your basic training is just not
enough
to see whether it's legit or not and the
last one is because you're just
distracted at the moment so yeah um
maybe you know everything about fishing
meals but you're running running kids
around the house because you're working
from home they kind of get to school
because of covert
uh you have annoying colleagues in teams
meetings all day and you still have to
clear your uh clear your inbox or you
didn't have your morning coffee yet so
you're not as sharp as you would like
and in that case sometimes you click on
something so that's why fishing works
for example
um
by influencing um as an attacker um
influencing your your emotions you make
easier decisions or a decision decision
making is way easier
because it associates new information
with existing patterns you already know
so like a little bit like mental
shortcuts and by mental shortcuts i do
not mean these shortcuts of course
so if you have a phishing email you want
to influence someone to click or to yeah
to to to interact with the email whether
it's
um login or download or whatever
give information so the influence is
based on the email itself it's not only
the text it's way more than the text in
the email itself so um it's about the
link
or the attachment so uh what how do you
influence clicking on the link is the
link is it the domain name domain name
that is known is it something typos
quoted for example is it a legit service
with hosted malware uh does it contain
an attachment um is that attachment
named like an attachment that should
be relevant for the for the recipient
for example um and next to that we have
the content so um next to the to the
page you have to contact how many meals
constructed um itself so the email body
um so i'm talking about the language
what language was used is the language
also the used language and the
organization does it have a design is it
plain text or is the copied corporate
identity from another known organization
or is it just neutral and does it
contain personal information sometimes
you see that it has to do the the
correct salutation so dear miss on the
mouse occurs or sometimes um it also has
some some personal information like your
email or linkedin profile and such so
attackers also influence people by using
personal information of that person
they got from
from open source
and the last one is the context so
that's everything around the content and
debate and the attachment so that could
be who's the sender is it something
someone you know is it someone internal
in your organization is it a colleague
is it from a company you know it or is
the company you should know
no
um
those are all the possibilities what is
the theme of the email is the relevant
activity um or
is it something you really like is it
for charity you really like is it about
your hobbies is it about your recent
event uh is it the timeless activity
just like here's my payslip for example
and the goal
what is the goal of the attacker is
sending the message um is it getting
information uh by replying and sending
it sending you to a login page
maybe
get you a payment done
or
download an attachment somewhere so it
has different goals so if you
if you combine this all
uh you can get a gr you can create a
framework so uh that's this framework i
made this framework
next to the all these items i just uh i
just named um one of the most important
is the principle of influence so you can
apply principles of influence defined by
cialdini he has defined seven
principles of influence you can apply to
every
part of an email so the content to
contacts and um
and the debate for example so before i
start
telling about the principles of
influence on apt fishing males i'm going
to introduce introduce you to uh five
uh principles of influence in apt
fishing wheels well cieldini defined
seven but i think five are only suitable
for uh for emails so i'll show you a
couple
uh with a couple of uh of examples so
the first one is reciprocation
and that means that if i do something
for you you do something for me back um
well that's nice so
so um that's why i want to offer you
something so you do something back i
think you see that a lot in emails
um where they offer coupon if you
register or log in or something
but you also see them with in more
malicious meals by offering you helping
you and then asked for for a favor so in
this email i um notified someone that
the
their account was going to expire and
you have to log in to reactivate it well
as a recipient you're thinking okay
thank you for letting me know i will
definitely log in because you feel like
indebted somehow
so that's the first one
the second one is an email and it was
actually
highly
well
it was not copied but i was highly
influenced by uh by one of the apt
groups this was an email sent by lazarus
group uh in the cofit times and in the
email um they said
a package they sent out a package of
temporary timely and targeted measures
to support public services people and
businesses through this period of
disruption caused by government
um
so they are offering you a package to
help you
and the late last day to register your
business is 2016 june 26 2020 by 2 pm
and this was sent in this in the same
week so actually
they want you to do something
in a short period of time and you call
it scarcity
so you offer something for a short
period of time people think we need to
do this we don't want to miss out and we
should click you also see that on
websites and the fishing mills oh only
one day left we only have limited stock
please buy from us
well there's a principle of influence
that is proven to to be a working
principle
um and then the third one is authority
and i think this is a really clear one
if someone sends you a mail from a
proven or known authority i think you're
more likely to click on that link or on
the attachment so in this
example i used the ceo
which is just like ceo fraud okay um you
must assure that all the pending deal
payment shall be completed by the end of
the day um this was uh
an example highly inspired by ta 505
email so i saw this email several times
asking if you could please do a payment
and payment instructions and information
was in the attachment um so this is one
that really works as well
and then uh the next one is the
principle of liking
if
someone has shared interest or you just
like someone because it's a colleague
it's a known person you are more likely
to interact with the email so now i made
an um made an email it was a little bit
inspired by an email of apt 28 uh where
i say ho ho ho it's almost christmas
and the elves are working really hard
and have a message for you and it was
sent by santa or the holiday committee
committee from the organization you
think i really like that person they
also really like
really nice christmas branches
i'm going to click on that link because
i want to see my christmas greeting
and the last one uh but definitely not
the least i really like this one is the
principle of social proof um
i have here an example it's a it's a
linkedin header and you maybe you think
okay but why is this principle social
proof this principle of social proof is
like if someone likes it and you really
know then you would also like it and
this one is inspired by also a lazarus
um
a lazarus attack um because there was a
person they created a person on linkedin
added a lot of your colleagues and then
wanted to chat with you so you check out
the connections the shared connections
and you see okay i have a lot of shared
connections so this person should be a
nice person or i could trust this person
so this is the way that they wanted to
influence the person receiving the
connection request from wilson
i think in the real
life
you also see this a lot on the website
booking.com they are really good
influencers because it's also known that
the principle of social proof is used on
the website by saying 40 people of your
country book this room today hurry up
hurry up um that's also
the principle of social proof because
you know that a lot of people from the
same country also booked that hotel so
it should be right right
so these are the principles of influence
and now i'm going to apply those
principles of influence and everything
what is in an email on emails of an apt
so first i need emails of an apt of
course so i needed an adversary the
emails data set so first
okay i need adversaries which ones are
the most suitable for my research so
first check out all the adversaries who
have a fishing procedure uh defined well
you can check out the mitral tech
framework and you see that there are a
lot of uh adversaries using spearfishing
so that's really nice
second is okay
i need to
choose what kind of groups are
interesting for my
adversary emulation so during a sea vest
or a tiger you have to select a real
threat for the organization so i need a
real threat for the organization
what are the most uh
most likely threats for an organization
that's the insider threat a crime group
a nation state and a pro a nation to
estate slash proxy well insider threat
is not going to work if i want to do an
adversary simulation so i have prime
groups and nation states left so with
this information and
choosing
multiple groups over the world i came
with ta 505
apt-28 apt40 and 80-38
so these are the four groups i selected
for my research because these are really
good groups we should use during our
next adversaries emulation
um
so how do i do the
research then
um i got a lot of emails
i got some from my pride intel
colleagues which are really badass in
gathering these
but i also found a lot on fire's total
because you can find for
attachments with attack attachment and
if you know the iocs of the
or the hashes of the malware docs you
can find the current email parent of
that of those
documents as well on various total if
you do some advanced searching so that's
why uh that's how i found 200 emails of
of apts um and the next one is getting
screenshots from research a lot of
companies uh did already a lot of
research on this uh one not on this
topic but on uh phishing um
of apts so they presented it in a
research report okay we saw a full
attack of this apt and it started with
this email so i gathered all the
screenshots of those
of those phishing emails and also used
it to enrich my first data set
and the last one is finding the
associated iocs
of these apts for example domains will
tell you how the phishing domains are
constructed if you find modocs you see
how they use the principle uh principle
of influence in the mahadox etc so find
also other information in other sources
about these apts
um so now we're going to apply the
research of principles of influence on
those
groups so first
my first one is uh russia so groups on
russia i'm going to start with the least
advanced to the most advanced
so i start with ta505 that's not really
an apt but i guess you also have to
emulate crime groups during uh cbs or
tiber so that's why i choose this one
it's tfta 505 located in russia and i
would call those this group hashtag lazy
mode it's really a lazy mode because
they're not really an influencer to be
honest so what i see
is that they use they don't use really
they don't use uh influencing techniques
in their mail they just say this email
is sent automatically or please see
attachment or please pay this by the end
of the day um so
yeah maybe a little bit of scarcity but
not really
that they're using
they are using the the principles of
influence in their meals
um also what i saw is that emails are
impersonal can be sent to anyone so
there is no
right information personal information
right salutation or whatever in the
email
next one and i think that's really funny
the sender email address uh is not
matching the sender name what ta 505
does is compromise a lot of email
accounts and sends emails from those
compromised email accounts
so that they have to dkm and the dmarc
set correct so it won't actually end up
in your spam folder so they send emails
from those compromised account but they
change the sender names of it so it
looks like it's the sender
and what they do is that they
add html attachments
or maldox's attachments and sometimes
they also host it
on a website i see this more nowadays
with the a505 because it's really hard
to evade these spam filters and fire
scanners and stuff like that so i have
three examples of those emails where you
can see the lazy mode with the sender
email address and the sender name so
this is the first one the second one and
the third one and you see it's
in all the three emails it's sent from
krishna
up but the email addresses are different
every time
so this is what ta505 does
let's go to a more advanced advanced one
and that's apt-28
um and what i see in apt-28 that they
use two
main principles of influence that's
principle of liking and an authority
because they are
they are using an external company a
known company
copy everything from that and send
emails so they send
with spoofed domain names booth email
addresses for example or they use
authority by uh spoofing from an
internal colleague or
internal ceo or something so they use
the corporate uh
they use the corporate identity of
another organization like google or they
just use plain text or use the um
corporate identity used in the
organization they
are sending
from
sending from
um and what i see is that uh they
use domain names uh which are typos
quoted with predictable patterns so for
example when you have
a
subdomain they use their full name would
replace the subdomain by a dash so if
you have the website
onedrive.office365.com
they use the domain name office365
dot com
so that's fun um and they use the tlds
of a domain name in the domain name
itself so for example one is nato.int
they use nato dash ins.com to make it
look legit and next to that they also
use the
the regular type of squad kind of things
like using an rn to be an m for example
so these are two examples this is the
first one it's by google uh this is the
one used to uh to disrupt the uh hillary
clinton campaign a couple of years ago
in usa and this is the second one here
you see that you use the
of liking someone has the same interest
this is really on your
uh it's a known authority in the same
area as where you work in so
they use it this kind of way
then the next one going over to china i
chose apt40 well i don't know if they're
still active uh if you see the news from
last week's
um so what do they use they use the
principle of liking and they pick
relevant themes for the recipient
so they use the local news they use
activities and events in their emails
and those are the main theme of the
fishing meals so
to do that in order to do that they do
profiling of the victim by using open
sources to get more information about
the victim and enrich the email with
that kind of information to make it more
relevant
and what i see that the level of the
fishing mill is really diverse so i see
typos all the way everywhere and i see
really well crafted emails so um well
maybe it's because there are a couple of
people with
diverse levels of sending emails but it
could also be that they have someone for
creating the well-crafted emails and
when you interact they don't have that
person so it's uh it's not that good
anymore
i want see season to use maldox and
attachment or hosted on google drive for
example and when they send you to their
own website or compromised website you
can download uh you can download one of
their uh their droppers and it downloads
a payload for you and redirects it to a
to a legit document they also packed
with it
and the last one and that's north korea
uh and it's it's 838 or lazarus group
and i think this is my favorite as long
as
if you can have a favorite apt but this
is definitely my favorite apt because it
knows how to social engineer
they are building full characters or
impersonating real people to influence a
person they literally use every
principle of uh of influence in their um
in their campaigns so they're using
email linkedin telegram or twitter uh
for communicating with the people so
first do your initial uh chat on
linkedin then go to telegram that was
described in the camp kid in the dream
job campaign
research
they always use
important value for the recipient
they do a lot they target a lot of
military organizations so they really
read a lot about military operations in
order to make it more uh legit uh they
spoof email addresses or create an
unknown company
so if you are a recruitment company you
can also just register a new domain name
and call your recruitment company that
way uh so that's what they do
and they use uh dropbox or onedrive for
a delivering mower as well and they are
adapting to the language and form of
speech
but it's not always flawless
so um a couple of slides earlier i
showed you the rob wilson linkedin
profile
i created based on information in
research and this is um how it
um which
these are the next steps after someone
connected through with that brock wilson
you see that it sends a sense a message
i like to chat with you for a job
opportunity and then bonds with the
person and then add them on on telegram
and have some uh have some conversations
this one is one is about an assessment
someone needs to do in order to check if
it has the right expertise
and
send someone to a website
this was
this was covered in in the research of
this company
so concluding during your next adversary
emulation
i would please ask you just not grab the
default scenario from the shelf you have
you always use because it just works
please use your
creativity and create something that's
really like the the adversary you have
to emulate during uh during uh
the assignment um
check uh influence by using the content
of the of the email and the context uh
so not only uh change the um the text of
the email but make it a full package
check if there's a design check if they
um
they use uh typo squad domains etc
um but keep in mind
when you're performing an adversary
emulation you have maybe a couple of
weeks maybe a couple of months uh real
adversaries have like
a couple of months or years to perform
the attack so keep this in mind
sometimes you have to make choices based
on the time you have so sometimes you
have to have to make it a little bit
more advanced in order to have someone
click uh on the link or execute or open
uh your attachment
so if you want to read a little bit more
about this uh research uh or you want to
use it during your next adversary
emulation you can go to to my blog
it's uh here with the link and i made
for the four um
adversaries i made a full list with
examples what to use or what not to use
during your next fishing campaign
so this was my presentation i hope you
liked it and if you have some questions
please drop it in the chat and for now
thank you very much