{
  "name": "Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself",
  "slug": "phishing-campaigns-targeting-usps-see-as-much-web-traffic-as-the-usps-itself",
  "description": "Following the 2023 holiday season, Akamai researchers uncovered a significant amount of highly likely malicious activity and domains purporting to be associated with the United States Postal Service (USPS). Akamai researchers compared five months of DNS traffic to the legitimate domain, usps.com, with DNS traffic to illegitimate combosquatted domain names.",
  "published": "2024-04-29T17:15:55+00:00",
  "created_at": "2024-04-29T17:15:55+00:00",
  "modified_at": "2024-05-01T21:07:55+00:00",
  "created_at_opencti": "2024-04-29T17:15:55+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "amazon",
    "cobalt strike",
    "dll file",
    "dns query",
    "icedid",
    "javascript file",
    "lsass",
    "powershell",
    "sharefinder",
    "usps"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "172.86.125.227"
      },
      {
        "id": "",
        "name": "155.94.156.254"
      },
      {
        "id": "",
        "name": "155.94.151.28"
      },
      {
        "id": "",
        "name": "155.94.135.202"
      },
      {
        "id": "",
        "name": "107.150.7.53"
      },
      {
        "id": "",
        "name": "104.223.16.2"
      },
      {
        "id": "",
        "name": "usps.parceltracker-us.com"
      },
      {
        "id": "",
        "name": "us.ps393.com"
      },
      {
        "id": "",
        "name": "tools.usps-lookup.com"
      },
      {
        "id": "",
        "name": "uspsposts.com"
      },
      {
        "id": "",
        "name": "uspspostoffices.top"
      },
      {
        "id": "",
        "name": "uspspostoffice.top"
      },
      {
        "id": "",
        "name": "uspspost.me"
      },
      {
        "id": "",
        "name": "uspsos.com"
      },
      {
        "id": "",
        "name": "uspshelp.vip"
      },
      {
        "id": "",
        "name": "uspshelp.store"
      },
      {
        "id": "",
        "name": "uspsaps.top"
      },
      {
        "id": "",
        "name": "usps-stampservice.com"
      },
      {
        "id": "",
        "name": "usps-shopusa.shop"
      },
      {
        "id": "",
        "name": "usps-shop.shop"
      },
      {
        "id": "",
        "name": "usps-pst.xyz"
      },
      {
        "id": "",
        "name": "usps-postoffices.top"
      },
      {
        "id": "",
        "name": "usps-post.world"
      },
      {
        "id": "",
        "name": "usps-post.vip"
      },
      {
        "id": "",
        "name": "usps-post.today"
      },
      {
        "id": "",
        "name": "usps-mlpackage.com"
      },
      {
        "id": "",
        "name": "usps-lookup.com"
      },
      {
        "id": "",
        "name": "usps-find.com"
      },
      {
        "id": "",
        "name": "usps-deliveryservice.icu"
      },
      {
        "id": "",
        "name": "stamps-usps.online"
      },
      {
        "id": "",
        "name": "gh-usps.shop"
      },
      {
        "id": "",
        "name": "appusps.com"
      },
      {
        "id": "",
        "name": "alter-usps.shop"
      },
      {
        "id": "",
        "name": "usps.solutions"
      }
    ],
    "malware": [
      {
        "id": "7f8b4fd1-1fc0-485e-a462-25f4aaf88ac1",
        "name": "Sharefinder",
        "slug": "sharefinder"
      },
      {
        "id": "dd9b4e0f-d393-4859-848f-b88656f0e9a1",
        "name": "IcedID",
        "slug": "icedid"
      },
      {
        "id": "906be30f-e4ec-4634-a6de-9c31d0234628",
        "name": "Cobalt Strike",
        "slug": "cobalt-strike"
      }
    ],
    "attack_patterns": [
      {
        "id": "c8e4e4bc-2dbe-4e80-9c4c-8c483f7a1085",
        "name": "T1187"
      },
      {
        "id": "d5c953ff-b143-41b6-bf2d-87b829132ea5",
        "name": "T1135"
      },
      {
        "id": "743d2e0c-e5d5-4ccb-a6bd-0035c4e88c37",
        "name": "T1176"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "64cdebc9-0fb4-48f2-bf4f-b87f3741f664",
        "name": "T1068"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://www.akamai.com/blog/security-research/2024/apr/phishing-usps-malicious-domains-traffic-equal-to-legitimate-traffic",
    "https://otx.alienvault.com/pulse/662ff1ec26bd06238df792e8"
  ]
}