INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
An unusual "shy z-wasp" phishing
Published: 2025-01-27
Last Updated: 2025-01-27 10:45:52 UTC
by Jan Kopriva (Version: 1)
Threat actors who send out phishing messages have long ago learned that zero-width characters and unrendered HTML entities can be quite useful to them. Inserting a zero-width character into a hyperlink can be used to bypass some URL security checks without any negative impact on the function of the link, while any unrendered entities can be used to break up any suspicious words or sentences that might lead to the message being classified as a potential phishing, without the recipient being aware of their inclusion.
One of the better-known techniques that depend on the use of zero-width characters (e.g., a Zero-Width Space – ​ a Zero-Width Non-Joiner – ‌ a Zero-Width Joiner – ‍ etc.) was named Z-WASP by the researchers in Avanan who first discovered it being used to bypass O365 security filters in 2018 [1]. Nevertheless, the aforementioned practice of using “invisible” characters in phishing messages is far older – for example, the soft hyphen or “SHY” html entity (­) has been used by threat actors at least since 2010[2].
Both of these techniques are relevant to the topic of today’s diary – an interesting phishing message that arrived in our hander mailbox late last week.
At first glance, it looked like any other run of the mill phishing message (apart from the use of an unusually small font and a somewhat difficult to see red spot under the “KEEP MY PASSWORD” link) ...
Read the full entry: https://isc.sans.edu/diary/An+unusual+shy+zwasp+phishing/31626/
[Guest Diary] How Access Brokers Maintain Persistence
Published: 2025-01-24
Last Updated: 2025-01-24 00:42:06 UTC
by Joseph Flint, SANS.edu BACS Student (Version: 1)
[This is a Guest Diary by Joseph Flint, an ISC intern as part of the SANS.edu BACS program]
Access brokers are groups referred to that obtain initial access in compromised environments, establish persistence through different methods, and sell this access to secondary bad actor groups who contribute to follow up attacks.
CrowdStrike wrote an article outlining desired targets typically involved with compromises that were shown to come from an access broker group. They broke down the top 10 targeted sectors for access brokers by percentage and found the following:
21% Academic
15% Government
13% Technology
9% Financial Services
9% Healthcare
8% Energy
7% Manufacturing
7% Industrials & Engineering
6% Legal
5% Insurance
Is your organization, or an organizations security posture you manage a part of this profile? For most Cybersecurity professionals the answer will be an overwhelming yes due to several factors including budgets for internal companies and for various audit requirements. These findings directly put environments related to these fields at risk as bad actors are looking to buy access to these environments.
Proofpoint outlined some commonly observed persistence mechanisms that are utilized by cyber criminals including a SystemBC botnet which is observed routinely in different environments I have personally worked on and across honeypot systems. Many botnets are observed scanning the internet for previously infected hosts. One of these examples comes from my own honeypot. Observed traffic from a Digital Ocean hosted IP shows web URL requests looking for this previously mentioned SystemBC directories ...
Read the full entry: https://isc.sans.edu/diary/Guest+Diary+How+Access+Brokers+Maintain+Persistence/31600/