{"id":951,"date":"2025-01-08T15:34:32","date_gmt":"2025-01-08T15:34:32","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/phishing-kampanja-usmjerena-na-europske-tvrtke-i-organizacije\/"},"modified":"2026-11-04T08:58:24","modified_gmt":"2026-11-04T08:58:24","slug":"phishing-kampanja-usmjerena-na-europske-tvrtke-i-organizacije","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/upozorenja\/phishing-kampanja-usmjerena-na-europske-tvrtke-i-organizacije\/","title":{"rendered":"Phishing kampanja usmjerena na europske tvrtke i organizacije"},"content":{"rendered":"\n

Istra\u017eiva\u010di iz Unit 42<\/strong> <\/a>nedavno su istra\u017eivali phishing kampanju usmjerenu na europske tvrtke, uklju\u010duju\u0107i one u Njema\u010dkoj i Ujedinjenom Kraljevstvu. Otkrili su da je cilj kampanje prikupljanje pristupnih podataka i preuzimanje kontrole nad \u017ertvinom Microsoft Azure Cloud infrastrukturom.<\/strong><\/p>\n\n\n\n

Phishing kampanja dosegla je vrhunac u lipnju 2024., uz kori\u0161tenje la\u017enih formi izra\u0111enih pomo\u0107u Free Form Builder <\/a><\/strong>usluge. Podaci pokazuju da je ciljano otprilike 20.000 korisnika<\/strong> iz razli\u010ditih europskih tvrtki.<\/p>\n\n\n\n


Kampanja je ciljala europske tvrtke u sljede\u0107im industrijama:<\/strong>
\u2022 Automobilska industrija
\u2022 Kemijska industrija
\u2022 Proizvodnja industrijskih spojeva<\/p>\n\n\n\n

Phishing mailovi sadr\u017eavali su ili prilo\u017eenu PDF datoteku<\/strong> sa zahtjevom za digitalni potpis (Docusign) ili HTML k\u00f4d s poveznicama<\/strong> koje su \u017ertve preusmjeravale na stranice (HubSpot) na kojima se nalazila forma (stvorena pomo\u0107u Free Form Buildera), koja je zatim preusmjeravala na phishing stranice s la\u017enom formom za prijavu u Outlook. HubSpot je platforma u oblaku za upravljanje odnosima s klijentima (CRM), marketing, prodaju i sustave za upravljanje sadr\u017eajem (CMS).<\/p>\n\n\n\n

Utvr\u0111eno je da HubSpot<\/strong> nije bio kompromitiran tijekom ove phishing kampanje, kao niti Free Form Builder<\/strong> poveznice dostavljene putem HubSpot infrastrukture.<\/p>\n\n\n\n

Iz Docusigna<\/strong>, su odgovorili: \u201cPovjerenje, sigurnost i privatnost na\u0161ih korisnika uvijek su bili u sredi\u0161tu poslovanja Docusigna. Od trenutka ove istrage, Docusign je implementirao niz dodatnih mjera za ja\u010danje na\u0161ih proaktivnih preventivnih mjera, koje su \u2014 do danas \u2014 zna\u010dajno smanjile broj korisnika koji primaju la\u017ene zahtjeve za Docusignovim potpisom.\u201d<\/p>\n\n\n\n

Slika 1 <\/strong>prikazuje pojednostavljeni dijagram phishing kampanje.<\/p>\n\n\n\n

\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button>
Slika 1<\/figcaption><\/figure>\n\n\n\n

Napada\u010di su prilago\u0111avali tematiku ovisno o kompaniji koju su ciljali.<\/strong> Npr. u nazivu dostavljene datoteke koristili su ime kompanije (imekompanije.pdf).<\/p>\n\n\n\n

PDF datoteke su upu\u0107ivale \u017ertvu da mora dati svoj digitalni potpis<\/strong>.<\/p>\n\n\n\n

\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button>
Slika 2<\/figcaption><\/figure>\n\n\n\n

Nakon \u0161to bi zaposlenik kliknuo \u201eView Document<\/strong>\u201c, poveznica bi ga odvela na URL <\/strong>formata - hxxps:\/\/share-eu1.hsforms[.]com\/FORM-ID koji je sadr\u017eavao formu (Slika 3)<\/strong>. <\/p>\n\n\n\n

\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button>
Slika 3<\/figcaption><\/figure>\n\n\n\n

U formi se spominje \u201eMicrosoft Secured Cloud<\/strong>\u201c, \u0161to upu\u0107uje da su napada\u010di ciljali korisni\u010dke podatke Microsoft ra\u010duna.<\/p>\n\n\n\n

Kad bi zaposlenik kliknuo \u201eView Document On Microsoft Secured Cloud<\/strong>\u201c, preusmjerili bi ga na zlonamjernu stranicu za kra\u0111u podataka<\/strong> koja je tra\u017eila unos pristupnih podatak Microsoft Azure ra\u010duna (Slika 4)<\/strong>.<\/p>\n\n\n\n

\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button>
Sliak 4<\/figcaption><\/figure>\n\n\n\n
Kako prepoznati ovu phishing kampanju<\/strong><\/h5>\n\n\n\n

Analizom phishing mailova ustanovljena su dva klju\u010dna pokazatelja:<\/p>\n\n\n\n

  1. Privid hitnosti<\/strong><\/li>
  2. Nisu prolazili autentifikacijske provjere<\/strong> \u2013 po\u0161iljatelj nije ovla\u0161ten slat poruke s navedene domene, a mogu\u0107e i daje potpis po\u0161iljatelja la\u017eiran.<\/li><\/ol>\n\n\n\n

    Za vrijeme istrage, prona\u0111eno je 17 aktivnih formi koje su vodile na stranice napada\u010da, a sve su bile na domeni .buzz <\/strong>te su imale sli\u010dan dizajn prikazan kao \u0161to prikazuje Slika 4.<\/p>\n\n\n\n

    Tijekom preuzimanja ra\u010duna, napada\u010di bi dodali novi ure\u0111aj na \u017ertvin ra\u010dun i tako omogu\u0107ili trajni pristup,<\/strong> \u010dak i nakon \u0161to su ulo\u017eeni sigurnosni napori da im se onemogu\u0107i pristup.<\/p>\n\n\n\n

    Kada je IT ponovno preuzeo kontrolu nad ra\u010dunom, napada\u010d je odmah pokrenuo ponovno postavljanje lozinke, poku\u0161avaju\u0107i vratiti kontrolu. To je stvorilo situaciju \u201enatezanja\u201c u kojoj su se obje strane borile za kontrolu nad ra\u010dunom.<\/p>\n\n\n\n

    Vi\u0161e o prijevari i indikatorima pro\u010ditajte na stranici: Effective Phishing Campaign Targeting European Companies and Organizations<\/a><\/strong><\/p>\n\n\n\n

    Otkrivene poveznice sa zlonamjernim formama:<\/strong>
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1P_6IFHnbRriC_DG56YzVhw2dz72l
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1UgPJ18suRU-NEpmYkEwteg2ec0io
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/12-j0Y4sfQh-4pEV6VKVOeg2dzmbq
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1cJJXJ0NfTPOKwn23oAmmzQ2e901x
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1wg25r1Z-R5GkhY6k-xGzOg2dvcv5
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1G-NQN9DbSVmDy1HDeovJCQ2ebgc6
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1AEc2-gS4TuyQyAiMQfB5Qw2e5xq0
    \u2022 hxxp:\/\/share-eu1.hsforms[.]com\/1wg25r1Z-R5GkhY6k-xGzOg2dvcv5
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1zP2KsosARaGzLqdj2Umk6Q2ekgty
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1fnJ8gX6kR_aa5HlRyJhuGw2ec8i2
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1QPAfZcocSuu3AnqznjU14A2eabj0
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/176T8k3N9Q562OEEfhS22Fg2ebzvj
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/18wO3Zb9hTIuittmhHvQFuQ2ec8gt
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1vNr8tB1GS4mZuYg81ji3dg2e08a3
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1qe8ypRpdTr284rkNpgmoow2ebzty
    \u2022 hxxps:\/\/share-eu1.hsforms[.]com\/1C1IZ0_b-SD6YXS66alL4EA2e90m9<\/p>\n\n\n\n

    Otkrivene zlonamjerne poveznice phishing kampanje \u2013 razina 1:<\/strong>
    \u2022 hxxps:\/\/technicaldevelopment.industrialization[.]buzz\/?o0B=RLNT
    \u2022 hxxps:\/\/vigaspino[.]com\/2doc5\/index.php?submissionGuid=1d51a08d-cf55-4146-8b5b-22caa765ac85
    \u2022 hxxps:\/\/technicaldevelopment.rljaccommodationstrust[.]buzz\/?WKg=2Ljv8
    \u2022 hxxps:\/\/purchaseorder.vermeernigeria[.]buzz\/?cKg=C3&submissionGuid=4631b0c9-5e10-4d81-b1d6-4d01045907e7
    \u2022 hxxps:\/\/asdrfghjk3wr4e5yr6uyjhgb.mhp-hotels[.]buzz\/?Nhv3zM=xI7Kyf
    \u2022 hxxps:\/\/purchaseorder.europeanfreightleaders[.]buzz\/?Mt=zqoE&submissionGuid=476f32d0-e667-4a18-830b-f57a2b401fc3
    \u2022 hxxps:\/\/orderspecification.tekfenconstruction[.]buzz\/?6BI=AmaPH&submissionGuid=e2ce33ea-ee47-4829-882c-592217dea521
    \u2022 hxxps:\/\/asdrfghjk3wr4e5yr6uyjhgb.mhp-hotels[.]buzz\/?Nhv3zM=xI7Kyf
    \u2022 hxxps:\/\/d2715zbmeirdja.cloudfront[.]net\/?__hstc=251652889.fcaff35c15872a69c6757196acd79173.1727206111338.1727206111338.1727206111338.1&__hssc=251652889.158.1727206111338&__hsfp=1134454612&submissionGuid=30359eaf-a821-472d-ba17-dd2bd0d96b96
    \u2022 hxxps:\/\/docusharepoint.fundament-advisory[.]buzz\/?3aGw=Nl9
    \u2022 hxxps:\/\/wr43wer3ee.cyptech[.]com[.]au\/oeeo4\/ewi9ew\/mnph_term=?\/&submissionGuid=50aa078a-fb48-4fec-86df-29f40a680602
    \u2022 hxxp:\/\/orderconfirmation.dgpropertyconsultants[.]buzz\/
    \u2022 hxxps:\/\/espersonal[.]org\/doc0024\/index.php?submissionGuid=6e59d483-9dc2-48f8-ad5a-c2d2ec8f4569
    \u2022 hxxps:\/\/vigaspino[.]com\/2doc5\/index.php?submissionGuid=093410a5-c228-4ddf-890c-861cdc6fe5d8
    \u2022 hxxps:\/\/technicaldevelopment.industrialization[.]buzz\/?o0B=RLNT
    \u2022 hxxps:\/\/espersonal[.]org\/doc0024\/index.php?submissionGuid=96a9b82a-55d3-402d-9af4-c2c5361daf5c
    \u2022 hxxps:\/\/orderconfirmating.symmetric[.]buzz\/?df=ZUvkMN&submissionGuid=e06a1f83-c24e-4106-b415-d2f43a06a048<\/p>\n\n\n\n

    Otkrivene zlonamjerne poveznice phishing kampanje \u2013 razina 2:<\/strong>
    \u2022 hxxps:\/\/docs.doc2rprevn[.]buzz?username=
    \u2022 hxxps:\/\/docusharepoint.fundament-advisory[.]buzz\/?3aGw=Nl9
    \u2022 hxxps:\/\/9qe.daginvusc[.]com\/miUxeH\/
    \u2022 hxxps:\/\/docs.doc2rprevn[.]buzz\/?username=
    \u2022 hxxps:\/\/vomc.qeanonsop[.]xyz\/?hh5=IY&username=ian@deloitte.es
    \u2022 hxxps:\/\/sensational-valkyrie-686c5f.netlify[.]app\/?e=<\/p>\n\n\n\n

    IP adrese:<\/strong>
    \u2022 167.114.27[.]228
    \u2022 144.217.158[.]133
    \u2022 208.115.208[.]118
    \u2022 13.40.68[.]32
    \u2022 18.67.38[.]155
    \u2022 91.92.245[.]39
    \u2022 91.92.244[.]131
    \u2022 91.92.253[.]66
    \u2022 94.156.71[.]208
    \u2022 91.92.242[.]68
    \u2022 91.92.253[.]66
    \u2022 188.166.3[.]116
    \u2022 104.21.25[.]8
    \u2022 172.67.221[.]137
    \u2022 49.12.110[.]250
    \u2022 74.119.239[.]234
    \u2022 208.91.198[.]96
    \u2022 94.46.246[.]46<\/p>\n\n\n\n

    Nazivi zlonamjernih PDF datoteka<\/strong>
    \u2022 (Zoomtan.pdf) b2ca9c6859598255cd92700de1c217a595adb93093a43995c8bb7af94974f067
    \u2022 (Belzona.pdf) f3f0bf362f7313d87fcfefcd6a80ab0f18bc6c5517d047be186f7b81a979ff91
    \u2022 (Pcc.pdf) deff0a6fbf88428ddef2ee3c4d857697d341c35110e4c1208717d9cce1897a21<\/p>\n","protected":false},"excerpt":{"rendered":"

    Istra\u017eiva\u010di iz Unit 42 nedavno su istra\u017eivali phishing kampanju usmjerenu na europske tvrtke, uklju\u010duju\u0107i one u Njema\u010dkoj i Ujedinjenom Kraljevstvu. Otkrili su da je cilj kampanje prikupljanje pristupnih podataka i preuzimanje kontrole nad \u017ertvinom Microsoft Azure Cloud infrastrukturom. Phishing kampanja dosegla je vrhunac u lipnju 2024., uz kori\u0161tenje la\u017enih formi izra\u0111enih pomo\u0107u Free Form Builder […]<\/p>\n","protected":false},"author":3,"featured_media":1523,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[23],"tags":[],"tema":[],"class_list":["post-951","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-upozorenja"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=951"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/951\/revisions"}],"predecessor-version":[{"id":1526,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/951\/revisions\/1526"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1523"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=951"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=951"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}