Luna Moth Gang Invests in Call Centers to Target Businesses with Callback Phishing Campaigns

The Luna Moth campaign has extorted hundreds of thousands of
dollars from several victims in the legal and retail sectors.

The attacks are notable for employing a technique called
callback phishing^[1]
or telephone-oriented attack delivery (TOAD^[2]), wherein the victims
are social engineered into making a phone call through phishing
emails containing invoices and subscription-themed lures.

Palo Alto Networks Unit 42 said the attacks are the “product of
a single highly organized campaign,” adding, “this threat actor has
significantly invested in call centers and infrastructure that’s
unique to each victim.”

The cybersecurity firm described^[3]
the activity as a “pervasive multi-month campaign that is actively
evolving.”

What’s notable about callback phishing is that the email
messages are completely devoid of any malicious attachment or
booby-trapped link, allowing them to evade detection and slip past
email protection solutions.

These messages typically come with an invoice that includes a
phone number that the users can call to cancel the supposed
subscription. In reality, however, the victims are routed to an
actor-controlled call center and connected to a live agent on the
other end, who ends up installing a remote access tool for
persistence.

“The attacker will then seek to identify valuable information on
the victim’s computer and connected file shares, and they will
quietly exfiltrate it to a server they control using a file
transfer tool,” Unit 42 researcher Kristopher Russo said.

The campaign may be resource intensive, but is also technically
less sophisticated and likely to have a much higher success rate
than other phishing attacks.

On top of that, it enables extortion without encryption,
permitting malicious actors to plunder sensitive data sans the need
to deploy ransomware to lock the files after exfiltration.

The Luna Moth actor, also known as Silent Ransom, has become an
expert of sorts when it comes to pulling off such schemes.
According to AdvIntel, the cybercrime group is believed to be the
mastermind behind the BazarCall attacks^[4]
last year.

To give these attacks a veneer of legitimacy, the adversaries,
instead of dropping a malware like BazarLoader, take advantage of
legitimate tools like Zoho Assist to remotely interact with a
victim’s computer, abusing the access to deploy other trusted
software such as Rclone or WinSCP for harvesting data.

Extortion demands range from two to 78 Bitcoin based on the
organization targeted, with the threat actor creating unique
cryptocurrency wallets for each payment. The adversary is also said
to offer discounts of nearly 25% for prompt payment, although
there’s no guarantee that the data is deleted.

“The threat actors behind this campaign have taken great pains
to avoid all non-essential tools and malware, to minimize the
potential for detection,” Russo said. “Since there are very few
early indicators that a victim is under attack, employee
cybersecurity awareness training is the first line of defense.”