{"id":941,"date":"2020-02-03T16:30:18","date_gmt":"2020-02-03T12:30:18","guid":{"rendered":"https:\/\/www.techxmedia.com\/?p=941"},"modified":"2025-04-17T23:59:22","modified_gmt":"2025-04-17T19:59:22","slug":"new-watering-hole-identified-for-credential-harvesting","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/new-watering-hole-identified-for-credential-harvesting\/","title":{"rendered":"New watering hole identified for credential harvesting"},"content":{"rendered":"\n

During the analysis of the xHunt campaign activities, researchers from Unit 42, the threat intelligence arm of Palo Alto<\/a> Networks, identified a Kuwaiti organization\u2019s webpage used as an apparent watering hole. The webpage contained a hidden image which was observed between June and December 2019 and referenced domains associated with malicious activity conducted by the xHunt campaign operators.<\/p>\n\n\n\n

Unit 42 believes that the same threat\nactors involved in the Hisoka\nattack campaign <\/a>compromised and injected this HTML code into this website\nin an attempt to harvest credentials from the website\u2019s visitors; specifically,\ngathering account names and password hashes. While Unit 42 cannot confirm this,\nit is possible that the actors intended to crack these hashes to obtain the\nvisitor\u2019s passwords or using the hashes gathered to carry out relay attacks to\ngain access to additional systems.<\/p>\n\n\n\n

If successful in harvesting account\ncredentials, the compromised data has a plethora of uses for the attackers and\ncan allow them to breach an organization to steal sensitive information.\nFurthermore, because they\u2019d be using trusted credentials, it can allow\nattackers to go undetected for long periods of time, enabling them to\ninfiltrate other parts of an organization and even implement backdoors, like\nRATs, to get back into a system even after being removed. This can result in\nsignificant damage to an organization over a prolonged period of time.<\/p>\n\n\n\n

During this same timeframe, Unit 42\nobserved an indication of DNS redirect activity on infrastructure used by these\nsame operators. The domains observed in redirect activity primarily contained\nsubdomains referencing an association with their organizational email servers\nfurther implying an interest in user credential harvesting.<\/p>\n","protected":false},"excerpt":{"rendered":"

If successful in harvesting account credentials, the compromised data has a plethora of uses for the attackers and can allow them to breach an organization to steal sensitive information. <\/p>\n","protected":false},"author":8,"featured_media":942,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[9685],"tags":[285],"contributor":[],"class_list":["post-941","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-events-middle-east","tag-xhunt"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2020\/02\/Cyber-crime.png","author_info":{"display_name":"Rabab","author_link":"https:\/\/techxmedia.com\/en\/author\/rabab\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t