Energy Sector Alert! Large-Scale Phishing Campaign Underway

According to the latest news, a leading US energy company has suffered a phishing campaign utilizing QR codes.

Starting from May 2023, researchers discovered a large-scale phishing campaign that uses QR codes for attacks, aimed at stealing Microsoft credentials of users across multiple industries.

One of the targets of the hacker attack was a prominent US energy company.

"Starting from May 2023, this large-scale phishing campaign utilized QR codes to target credentials of Microsoft users from various industries. The most notable target was a large US-based energy company, where approximately 29% of over 1,000 emails containing malicious QR codes were discovered. The other four major target industries included manufacturing, insurance, technology, and financial services, accounting for 15%, 9%, 7%, and 6% of the campaign traffic, respectively."

Most of the links contained in the phishing emails consisted of Bing redirect URLs. Other notable domains included krxd[.]com (associated with Salesforce applications) and cf-ipfs[.]com (Cloudflare's Web3 service).

Compared to phishing links directly embedded in emails, using QR codes has several advantages, the most important being the ability to bypass anti-phishing measures because the phishing link is hidden inside the QR code image.

Researchers observed that the campaign's average monthly growth rate exceeded 270%. Since May 2023, the entire campaign has grown by more than 2,400%.

This is the largest QR code-utilizing campaign observed to date, a situation that indicates attackers are testing the effectiveness of QR codes.

The phishing messages used in this campaign included PNG images or PDF attachments with QR codes. The content of the emails attempted to deceive recipients into scanning the code to verify their accounts. The emails urged recipients to complete the action within 2-3 days.

PNG images or PDF attachments with QR codes

"The lure of the emails came in the form of updating 2FA, MFA, and general account security. While the energy company only accounted for 29% of the total traffic, the company found that 81% of the campaigns utilized Bing redirect URLs.

Experts warn that the energy sector is the main focus of this operation, followed by manufacturing and insurance. The report states that the volume in the energy sector increased due to a massive two-day campaign at the end of June.

While QR codes are legitimate channels, attackers also have reasons to use them. Firstly, malicious QR codes can reach the inbox with malicious links hidden inside the QR codes. Secondly, they can be embedded in other images, disguising QR codes as image attachments, or embedding images into PDF files. While automated technologies such as QR code scanners and image recognition can serve as the first line of defence, there is no guarantee that QR codes will be recognized. Especially if it is embedded in PNG or PDF files. Therefore, employees must be trained not to scan QR codes in emails they receive."

Last year, warnings from relevant agencies in several countries indicated that cybercriminals are using QR codes to steal their credentials and financial information.

It is recommended to check the URLs obtained by scanning QR codes to ensure it is the correct website and looks genuine. Attackers may use malicious domains similar to the expected URL, but with typos or misplaced letters.

Before providing login, personal, or financial information, carefully check any website navigated to from a QR code.

If scanning a physical QR code, ensure the QR code has not been tampered with, such as checking if a new sticker is covering the original QR code.

Do not download applications via QR codes, and avoid requesting payments through unsolicited emails that use social engineering techniques to trick recipients into scanning embedded QR codes.

Do not download QR code scanning applications from unofficial stores to avoid being infected; most mobile phones now have built-in QR code scanners through the camera application.

If users receive a QR code from someone they know, they can contact them through another channel to verify if the code came from them.

Never make payments through websites navigated to via QR codes; it is recommended to manually enter a known and trusted URL to complete the payment.

The public should be aware of fraudulent schemes utilizing cryptocurrency ATMs and Quick Response (QR) codes to complete payment transactions. This payment method makes it very difficult to recover funds stolen through fraudulent means.

The Security Gauge Validation Platform is capable of simulating a series of cyber fraud attack behaviours, such as phishing emails containing malicious links or malicious attachments, providing enterprises with secure and effective defence system validation services. Through visual reports, it helps enterprises clarify shortfalls in their defence systems and make corresponding adjustments and preparations, reducing the cost spent by security teams on processing phishing emails.

You can easily select validation experiments of phishing emails containing malicious links or malicious attachments in the Security Gauge Validation Platform, and specify AI bots to send these emails to specified email addresses in the enterprise email system to verify whether your enterprise's email security products have the ability to detect and isolate or delete these phishing emails.