Campaign or TTP Overview

In early October 2023, the Redtail phishing campaign was observed targeting organizations across various sectors, with a primary focus on financial services and tech companies. While attribution remains speculative, the phishing attempts are believed to be orchestrated by a threat actor group with a history of targeting high-value entities. The campaign was marked by its adaptive phishing payloads designed to bypass standard email filters and dupe well-trained employees into leaking credentials or executing malware on their systems.

What set the Redtail campaign apart was its nuanced understanding of the target organization’s internal communication style. By mimicking real email patterns from within, it created convincing impersonations of executives and other internal figures, vastly increasing the likelihood of engagement.

How It Was Built

The Redtail campaign leveraged strategically crafted payloads and meticulously forged sender identities to infiltrate email defenses. The infrastructure behind the campaign involved a sophisticated command-and-control (C2) setup with domain names closely resembling legitimate business entities. Threat actors utilized compromised servers to relay their messages, ensuring the emails originated from reputable IP addresses.

The delivery mechanism primarily employed email, with patterns including subject lines such as “Critical Update Required for Your Account” and “Please Review Urgent Document Attached”. These themes were carefully chosen for their urgency and relevance to the targeted user base. Lure content was customized, with URLs obfuscated to appear as internal company portals using techniques like subdomain manipulation.

From: "IT Support" <support@itservices-company.com>

Subject: Critical Update Required for Your Account

Date: October 12, 2023

To: targetuser@company.com



Hi [UserName],

  

We urgently request you to verify recent updates to your account information by visiting the secure link below. 



https://accounts.company-support.com/verify?sessionid=abcd1234



Failure to comply will result in temporary account suspension.



Best,

IT Support Team

The above email format was effective in deceiving recipients into believing it was a legitimate communication from their internal IT department, prompting them to interact with a malicious link leading to a credential-harvesting site.

Why It Worked

The effectiveness of the Redtail campaign largely stemmed from three core elements:

• Sender Identity Crafting: By forging sender addresses that closely matched those of actual company IT departments, the emails bypassed superficial scrutiny.
• Clever Domain Spoofing: The domain variations used were not only sophisticated but blended seamlessly into the expected web environment of the targets, thus reducing suspicion.
• Targeted Content Personalization: Customizing emails with user names and relevant context ensured that recipients felt a direct and urgent need to respond.

Operator Takeaways

Red team operators can extract several lessons from the Redtail campaign to enhance their own simulation exercises. First, crafting emails that accurately emulate internal styles and lexicon is crucial. Understanding the internal culture and communication may involve gathering OSINT to better mimic internal communications.

Furthermore, leveraging domain generation techniques that subtly manipulate known URLs can make phishing infrastructure appear insider-generated. Finally, focusing on creating a seamless experience from the email to the link destination minimizes red flags that might alert a cautious user.

Good / Better / Best

• Good: Use generic email templates with slightly modified sender information. This can catch some users off-guard but may fail against those with basic awareness.
• Better: Customize emails to reflect the target’s real internal communication patterns, making use of publicly available information to refine sender details and content.
• Best: Employ both customized communication and sophisticated domain spoofing. Observe specific internal styles, and implement website clones that directly replicate target portals, creating an almost undetectable phishing sequence.

References

Aaron Ng’s Guest Diary on Phishing Payload Patterns

Further Reading on Phishing Techniques

Related Reading

• What is Payload Delivery in Phishing?
• Understanding Payload Delivery Mechanisms in Phishing
• Metabase SQL Injection Vulnerability in Real-World Phishing Campaigns

Educational Purpose: This content is provided for awareness and defensive purposes only. Understanding attacker methodologies helps individuals and organizations protect themselves.

Campaign or TTP Overview

In July 2023, the Redtail campaign launched a targeted phishing attack against financial institutions across North America, focusing particularly on executives and IT staff. The campaign’s precision and timing indicate thorough reconnaissance and targeting. The attackers employed high-quality business email compromise (BEC) tactics, inserting themselves into ongoing email threads to bolster authenticity and diminish suspicion. According to the SANS Internet Storm Center, the phishing emails originated from domains that subtly mimicked known and trusted entities within the industry.

The Redtail campaign stands out due to its multi-vector approach, integrating not only email phishing but also leveraging compromised legitimate websites as part of its attack payload delivery mechanism. The campaign has been ongoing, with iterative refinements that have made detection increasingly challenging. Victims were chosen based on public facing information, such as LinkedIn profiles, allowing customized lures that resonated with their professional responsibilities.

How It Was Built

At the core of the Redtail campaign’s success was its infrastructure setup and distribution methods. By using a combination of subtly altered domains and real-time content adaptation, the attackers bypassed traditional defenses. The domains, though similar, featured character replacements like “exämplefinance.com,” capitalizing on Unicode homographs to deceive visual inspection.

Email Subject: Invoice #38723 - Urgent Review Required

From: billing@exämplefinance.com

To: target@example.com

Body: 

Dear [Executive Name],



Please review the attached invoice at your earliest convenience. This urgent billing issue requires your immediate attention to prevent service disruption.



Best,

[Real Employee Name]

[Real Company Address]

Attachment: invoice_38723.docm

Each email contained macro-loaded documents designed to perform reconnaissance and deliver subsequent stages of payloads, primarily focusing on credential theft and remote access trojans (RATs). Once opened, the documents requested permissions under the guise of enabling editing or content, triggering the hidden macros. Through the use of encoded PowerShell scripts, the payload proceeded to download additional components from compromised legitimate sites.

Why It Worked

The Redtail campaign exploited specific weaknesses at the intersection of human psychology and technical safeguards. First, the trust factor was significant, as emails appeared to arrive from known internal contacts, exploiting the natural trust humans place in familiar structures. Secondly, by embedding themselves into ongoing conversations, they minimized the anomaly factor, making the phishing attempt feel like a direct continuation of prior communication.

The campaign’s construction of homograph domains effectively bypassed domain filtering technologies that rely on exact string matching, rendering traditional email filtering tools less effective. The attackers’ choice of initialized macros as a delivery vector leveraged common user behavior: clicking “Enable Content” due to unintended consequences like disabled editing features in legitimate documents.

Operator Takeaways

For red team operatives looking to enhance their own engagements, the Redtail campaign underscores the importance of both technical precision and social engineering prowess. Leveraging Unicode in domain mimicry requires attention to detail but yields significant success in bypassing automated defenses. Additionally, persistence in legitimate email threads can dramatically increase engagement rates compared to cold-call phishing attempts.

Incorporating multi-stage payloads that adapt in real-time based on the environment can complicate defensive measures and reduce the likelihood of detection post-execution. Crafting lures that align with the business cycle of the target organization enhances realism, further improving engagement.

Good / Better / Best

Good: Deploying phishing emails with minimal personalization and technically sound payloads can achieve baseline success against less vigilant targets.

Better: Integrating into existing communication threads and employing Unicode domain techniques raises success significantly by leveraging established trust relationships.

Best: Dynamic payloads that adapt and continue to evolve as they interact with the victim’s system, paired with personalized lures based on extensive reconnaissance, epitomize top-tier phishing campaign success.

References

• SANS Internet Storm Center Diary Entry on Redtail
• Security Intelligence: Mimicking Strategies in Successful Phishing

Related Reading

• What is Payload Delivery in Phishing?
• Understanding Payload Delivery Mechanisms in Phishing
• Advanced Techniques for Evading Detection in Phishing Campaigns
• Effective Social Engineering through Email Crafting: Techniques and Strategies

Educational Purpose: This content is provided for awareness and defensive purposes only. Understanding attacker methodologies helps individuals and organizations protect themselves.