Robin Banks Phishing Service for Cybercriminals Returns with Russian Server

A phishing-as-a-service (PhaaS) platform known as Robin
Banks has relocated its attack infrastructure to
DDoS-Guard, a Russian provider of bulletproof hosting services.

The switch comes after “Cloudflare disassociated Robin Banks
phishing infrastructure from its services, causing a multi-day
disruption to operations,” according to a report^[1]
from cybersecurity company IronNet.

Robin Banks was first documented^[2]
in July 2022 when the platform’s abilities to offer ready-made
phishing kits to criminal actors were revealed, making it possible
to steal the financial information of customers of popular banks
and other online services.

It was also found to prompt users to enter Google and Microsoft
credentials on rogue landing pages, suggesting an attempt on part
of the malware authors to monetize initial access to corporate
networks for post-exploitation activities such as espionage and
ransomware.

In recent months, Cloudflare’s decision to blocklist its
infrastructure in the wake of public disclosure has prompted the
Robin Banks actor to move its frontend and backend to DDoS-Guard,
which has in the past hosted^[3]
the alt-tech social network Parler^[4]
and the notorious Kiwi Farms^[5].

“This hosting provider is also notorious in not complying with
takedown requests, thus making it more appealing in the eyes of
threat actors,” the researchers noted.

Chief among the new updates introduced is a cookie-stealing
functionality, in what’s seen as an attempt to serve a broader
clientele such as advanced persistent threat (APT) groups that are
looking to compromise specific enterprise environments. It’s
offered for $1,500 per month.

This is achieved by reusing code from evilginx2^[6], an open source
adversary-in-the-middle (AiTM^[7]) attack framework
employed to steal credentials and session cookies from Google,
Yahoo, and Microsoft Outlook even on accounts that have
multi-factor authentication (MFA) enabled.

Robin Banks is also said to have incorporated a new security
measure that requires its customers to turn on two-factor
authentication (2FA) to view the stolen information via the
service, or, alternatively, receive the data through a Telegram
bot.

Another notable feature is its use of Adspect^[8], an ad fraud detection
service, to redirect targets of phishing campaigns to rogue
websites, while leading scanners and unwanted traffic to benign
websites to slip under the radar.

The findings are just the latest in a series of new PhaaS
services that have emerged in the threat landscape, including
Frappo, EvilProxy^[9], and Caffeine^[10], making cybercrime more
accessible to amateur and experienced bad actors alike.

What’s more, the improvements also illustrate the growing need
for threat actors to rely on different methods such as AiTM and
prompt bombing (aka MFA fatigue) – as recently observed in the case
of Uber^[11] – to circumvent
security measures and gain initial access.

“The infrastructure of the Robin Banks phishing kit relies
heavily on open-source code and off-the-shelf tooling, serving as a
prime example of the lowering barrier-to-entry to not only
conducting phishing attacks, but also to creating a PhaaS platform
for others to use,” the researchers said.