The campaign, discovered by researchers at Cofense Intelligence, leverages reconnaissance emails and instant messages to bait employees at luxury resorts and hotel chains into a response, according to a Cofense blog post published Sept. 26. Once the threat actors receive a response to the initial email, they will then follow up with phishing messages that leverage several methods known to disrupt email security analysis and secure email gateways (SEGs), so that the messages reach intended targets. These tactics include the use of trusted cloud domains in the emails, password-protected archives, and executable files that are so large they can disrupt analysis, according to the report.
"From the reconnaissance email all the way to the malicious payload, this campaign and its infection chain are both highly sophisticated and well-thought-out by the threat actors," Cofense cyber threat intelligence analyst Dylan Duncan wrote in the post.
This attention to detail is reflective in "the success of these emails reaching intended targets," with a notable uptick in the campaign through August and into September "at an alarming rate," he added. Indeed, 85% of the phishing emails observed in the campaign have been sent in the last 60 days, with September showing a higher incidence of messages than August, according to Cofense.
