The Devil, Eight Million Emails, and a Whole Lot of Milk

A Huntress SOC investigation uncovered a Romanian threat actor who compromised a small client's internet-facing RDWeb terminal server via brute-forced credentials and no MFA. The attacker staged Gammadyne Mailer (a legitimate bulk email tool) with 8.9 million recipient addresses on the compromised desktop, configured to impersonate UK pharmacy chain Boots with a fake customer satisfaction survey. The phishing payload was hosted on a hijacked Bolivian government website (ipelc.gob.bo) to bypass reputation filters. Direct-to-MX delivery via 666 threads meant the victim's IP — not the attacker's — would be blocklisted. Huntress isolated all 25 endpoints mid-send, blocking 29,954 outbound SMTP connections in a 104-second burst. The investigation also revealed the attacker had been operating from at least July 2025, rotating the same Gammadyne project file across multiple compromised terminal servers targeting UK audiences with retail, tax, and crypto-themed lures.

Nguồn: https://www.huntress.com/blog/terminal-server-phishing-stager-exposed. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.

Đề xuất cho bạn

BleepingComputer03 phút6 giờ trước

Bluekit phishing kit adopts browser-in-the-middle for login theft

Bluekit, a phishing-as-a-service platform first documented in April, has evolved to include browser-in-the-middle (BitM) capabilities using the open-source JavaScript library rrweb. This technique streams the legitimate login page's DOM to victims over WebSocket, allowing attackers to capture credentials and session tokens while bypassing MFA. The platform also features sophisticated anti-analysis defenses including randomized CSS filters, obfuscated JavaScript bundles, custom CAPTCHAs, browser fingerprinting, and WebRTC-based VPN/proxy detection. Nearly 70 new hostnames were identified in the past week, indicating active expansion. Indicators of Bluekit activity include WebSocket connections sending encrypted data on login pages and CSS filter manipulation on top-level HTML elements.

#phishingNguồn