Skip to main content
عربي
logo

NCSC-TAD-2102-001

Severity Level: Medium
Phishing

Reference No.: NCSC-TAD-2102-001CVSS 0

Phishing Campaign Leverages Telegram for Exfiltration

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

Multiple recent phishing campaigns in America and Europe were found to be employing source code obfuscation using domains with a poor reputation or compromised ones. Posing as legitimate websites were used to steal personal information like credit cards. Which was later exfiltrated through instant messaging platforms.

Mitigation and Immediate Actions

  1. 01

    Restrict administrative privileges to operating systems and applications based on user role. Regularly reassess the need for privileges. Don’t use privileged accounts for reading email and web browsing.

  2. 02

    User application hardening. Configure web browsers to block Flash (ideally uninstall it), ads and Java on the Internet. Disable unneeded features in Microsoft Office (e.g. OLE), web browsers and PDF viewers.

  3. 03

    Multi-factor authentication for VPNs, Outlook Web Access (OWA), RDP, SSH and other remote access, and for all users when they perform a privileged action or access an important (sensitive or high-availability) data repository.

References