The Red Team on Lapland Industries continues with a Vishing campaign to try and gain access to the naughty or nice list.
Voice Phishing or Vishing is a type of Social Engineering cybercrime that uses phone calls or voice messages in order to get the recipient to reveal personal information or allow access to a system or network.
Vishing, Phishing and Smishing have the same goal, the only thing different is the medium used to get victims to reveal their personal information.
These methods do not have to be in isolation, some attackers will utilise a combination of these methods to gain access. For example, a Smishing attack could start with an instant message and contain a telephone number for victims to call.
It can be harder to identify a Vishing attack over Phishing and Smishing. There are specific programs that mask voices and geographical accents, making it hard to recognise international callers. This can be particularly difficult for employees to identify in large organisations with high staff turnover, or no central database of staff details. A hacker can easily call a staff member pretending to be a new employee working in the IT department.
Following on from our Phishing campaign, we now have 11 elves login credentials, 5 of the accounts which have the access levels we require have Multi-Factor Authentication (MFA). They then targeted these accounts for a Vishing campaign. The first target for this was Hermey the Elf.
Having obtained Hermey’s valid credentials, the intentions were for Cybaverse to imitate an IT 3rd party and submit their password, with the intention to social engineer the MFA code to gain access to the network.
The next step was obtaining a contact number. It was possible to dial the number obtained from Google, which would allow a call to be put through to an Elf receptionist, who could forward the call to Hermey. Adding urgency to a call whilst adding the valid password that results in an MFA code makes the attack vector more successful.
Neither Hermey or any of the other elves would pass over their MFA codes and insisted their IT Department needed to authorise this first, which meant this Vishing attempt was unsuccessful. Many threat actors would continue to find another way of triggering MFA for a different, more susceptible set of elves.
Tomorrow Cybaverse will try another tactic used by the Gruber Group – Password Spraying. Cybaverse will look to complete a password spray based on information collected from the Lapland Industries Christmas party.
There are two main ways for organisations to protect themselves from Vishing campaigns.
Once the Vishing campaign was complete, Cybaverse updated Santa on their findings and made preparations for tomorrow's password spray attempt on Lapland Industries.