Redtail: Analyzing the Latest Phishing Payload Patterns

The recent Redtail phishing campaign, as documented by Aaron Ng in his guest diary, serves as a vivid example of the evolving sophistication in phishing attack strategies. This campaign illustrates not only the tactics used to distribute payloads but also provides a window into the psychological and technical mechanisms that make these attempts so effectively pervasive in today’s threat landscape.

Campaign or TTP Overview

In early October 2023, the Redtail phishing campaign was observed targeting organizations across various sectors, with a primary focus on financial services and tech companies. While attribution remains speculative, the phishing attempts are believed to be orchestrated by a threat actor group with a history of targeting high-value entities. The campaign was marked by its adaptive phishing payloads designed to bypass standard email filters and dupe well-trained employees into leaking credentials or executing malware on their systems.

What set the Redtail campaign apart was its nuanced understanding of the target organization’s internal communication style. By mimicking real email patterns from within, it created convincing impersonations of executives and other internal figures, vastly increasing the likelihood of engagement.

How It Was Built

The Redtail campaign leveraged strategically crafted payloads and meticulously forged sender identities to infiltrate email defenses. The infrastructure behind the campaign involved a sophisticated command-and-control (C2) setup with domain names closely resembling legitimate business entities. Threat actors utilized compromised servers to relay their messages, ensuring the emails originated from reputable IP addresses.

The delivery mechanism primarily employed email, with patterns including subject lines such as “Critical Update Required for Your Account” and “Please Review Urgent Document Attached”. These themes were carefully chosen for their urgency and relevance to the targeted user base. Lure content was customized, with URLs obfuscated to appear as internal company portals using techniques like subdomain manipulation.

From: "IT Support" &lt;support@itservices-company.com&gt;

Subject: Critical Update Required for Your Account

Date: October 12, 2023

To: targetuser@company.com

Hi [UserName],

We urgently request you to verify recent updates to your account information by visiting the secure link below. 

https://accounts.company-support.com/verify?sessionid=abcd1234

Failure to comply will result in temporary account suspension.

Best,

IT Support Team

The above email format was effective in deceiving recipients into believing it was a legitimate communication from their internal IT department, prompting them to interact with a malicious link leading to a credential-harvesting site.

Why It Worked

The effectiveness of the Redtail campaign largely stemmed from three core elements:

Sender Identity Crafting: By forging sender addresses that closely matched those of actual company IT departments, the emails bypassed superficial scrutiny.
Clever Domain Spoofing: The domain variations used were not only sophisticated but blended seamlessly into the expected web environment of the targets, thus reducing suspicion.
Targeted Content Personalization: Customizing emails with user names and relevant context ensured that recipients felt a direct and urgent need to respond.

Operator Takeaways

Red team operators can extract several lessons from the Redtail campaign to enhance their own simulation exercises. First, crafting emails that accurately emulate internal styles and lexicon is crucial. Understanding the internal culture and communication may involve gathering OSINT to better mimic internal communications.

Furthermore, leveraging domain generation techniques that subtly manipulate known URLs can make phishing infrastructure appear insider-generated. Finally, focusing on creating a seamless experience from the email to the link destination minimizes red flags that might alert a cautious user.

Good / Better / Best

Good: Use generic email templates with slightly modified sender information. This can catch some users off-guard but may fail against those with basic awareness.
Better: Customize emails to reflect the target’s real internal communication patterns, making use of publicly available information to refine sender details and content.
Best: Employ both customized communication and sophisticated domain spoofing. Observe specific internal styles, and implement website clones that directly replicate target portals, creating an almost undetectable phishing sequence.

References

Aaron Ng’s Guest Diary on Phishing Payload Patterns