Phishing of Awareness Training Brands

As threat actors constantly find creative and convincing ways to exploit trust and familiarity in their phishing campaigns, Mimecast threat researchers have identified a recent trend involving the impersonation of well-known security awareness training platforms such as KnowBe4 and Phish Insight. Since these platforms are widely used by organizations, they are ideal cover for attackers seeking to harvest credentials or spread malware.

A large portion of these phishing campaigns have employed domains that closely resemble legitimate ones, such as knowbe4.de.com and phishinsight.sa.com. Both domains have recently been registered and utilize Contabo GmbH's infrastructure to send emails.

Additionally, some of the campaigns using the same theme spoof the legitimate domains; however, checks such as SPF, DKIM, and DMARC help filter out most of these threats. Below are a couple of examples observed and detected by Mimecast

The links all redirect to a phishing page requiring the users to authenticate with their Microsoft credentials.

IOC’s

Targets

Global, All sectors

Sending email addresses

Sending IP’s

URL Domains

Recommendations

The increase in phishing campaigns impersonating security awareness training brands highlights the need for organizations to stay alert and act. It's vital to help staff recognize and report suspicious emails while also strengthening technical defenses such as email authentication and monitoring for threats. Collaborating with hosting providers and sharing intelligence across the cybersecurity community can go a long way in disrupting these attacks. By staying informed, using the right tools, and responding quickly, organizations can better protect themselves against these ever-evolving threats.

• Share updates on emerging phishing tactics to help employees recognise suspicious emails.
• Search your phishing/URL logs to determine if you have been a victim of this style of phishing attack using the published IOCs
• Ensure SPF, DKIM and DMARC checks are being conducts on all incoming emails and ensure your domain records are up to date.