{
  "name": "Rockstar 2FA: A Driving Force in Phishing-as-a-Service (PaaS)",
  "slug": "rockstar-2fa-a-driving-force-in-phishing-as-a-service-paas",
  "description": "This analysis explores the Rockstar 2FA phishing-as-a-service kit, focusing on real-world email campaign examples. It highlights various techniques used by attackers, including the abuse of legitimate services for FUD (Fully Undetectable) links, such as Microsoft OneDrive, OneNote, Dynamics 365, Atlassian Confluence, and Google Docs Viewer. The use of QR codes in phishing attempts and the insertion of stolen email threads to inflate message size are also discussed. The article emphasizes the multi-stage nature of these attacks and the importance of caution when dealing with emails sent through trusted platforms.",
  "published": "2024-12-04T22:12:34+00:00",
  "created_at": "2024-12-04T22:12:34+00:00",
  "modified_at": "2024-12-05T09:25:20+00:00",
  "created_at_opencti": "2024-12-04T22:12:34+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-12-03",
    "2024-12-04",
    "aitm",
    "dadsec",
    "email campaigns",
    "microsoft 365",
    "phishing",
    "phishing-as-a-service",
    "rockstar",
    "rockstar 2fa"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://www.curiosolucky.com/dos/"
      },
      {
        "id": "",
        "name": "https://vilug-onteroi.com.pl/RkHd/"
      },
      {
        "id": "",
        "name": "https://vidy-cloudy.com.pl/13SP"
      },
      {
        "id": "",
        "name": "https://urbanlifeinnolo.ru/KGgt"
      },
      {
        "id": "",
        "name": "https://vendantacoursessonu.ru/7VINm"
      },
      {
        "id": "",
        "name": "https://synthchromal.ru/Vc51/"
      },
      {
        "id": "",
        "name": "https://saluminyum.com/secure/index.html"
      },
      {
        "id": "",
        "name": "https://swiftsparkmon.ru/F4CQo/"
      },
      {
        "id": "",
        "name": "https://pfremiumshirts.store/D91p/"
      },
      {
        "id": "",
        "name": "https://novatechies.cbg.ru/BUeEj/"
      },
      {
        "id": "",
        "name": "https://payment-confirmation-to-your-bank-account-s-dabringhaus-licatec.packinqsystems.de/"
      },
      {
        "id": "",
        "name": "https://luthschoenmode.nl/winkel/generated/arull.php?7104797967704b536932307466507a53784b7a4d37494c79704b7a4d73723053744f314"
      },
      {
        "id": "",
        "name": "https://enterbuzztechscener.pl/pbtmx/"
      },
      {
        "id": "",
        "name": "https://googlevoicesecrets.com/EHkslw5/auth/?_kx=lKiN48B6FuEu_OYp2PJPXw.Sdgjsn"
      },
      {
        "id": "",
        "name": "https://docsecureatt-docdrive-filedoc.pages.dev/"
      },
      {
        "id": "",
        "name": "https://cyberdynalumeo.ru/1RB3Y/"
      },
      {
        "id": "",
        "name": "https://bytequestixo.pro/wWge/"
      },
      {
        "id": "",
        "name": "https://apexaurora.ru/SDoHg/"
      },
      {
        "id": "",
        "name": "https://pub-fe581134d7ae4857a97443270a27e0fa.r2.dev/0nedrive.html"
      },
      {
        "id": "",
        "name": "https://lifestylesyncteche.pro/Ykiy/"
      },
      {
        "id": "",
        "name": "https://54774675.rainblessings.pages.dev"
      },
      {
        "id": "",
        "name": "www.curiosolucky.com"
      },
      {
        "id": "",
        "name": "54774675.rainblessings.pages.dev"
      },
      {
        "id": "",
        "name": "vilug-onteroi.com.pl"
      },
      {
        "id": "",
        "name": "vidy-cloudy.com.pl"
      },
      {
        "id": "",
        "name": "vendantacoursessonu.ru"
      },
      {
        "id": "",
        "name": "urbanlifeinnolo.ru"
      },
      {
        "id": "",
        "name": "txjudge-mentsol.com.pl"
      },
      {
        "id": "",
        "name": "swiftsparkmon.ru"
      },
      {
        "id": "",
        "name": "saluminyum.com"
      },
      {
        "id": "",
        "name": "quedi.adv.br"
      },
      {
        "id": "",
        "name": "luthschoenmode.nl"
      },
      {
        "id": "",
        "name": "lifestreamtechho.ru"
      },
      {
        "id": "",
        "name": "apexaurora.ru"
      },
      {
        "id": "",
        "name": "system23cfb9.link.bmesend.com"
      },
      {
        "id": "",
        "name": "payment-confirmation-to-your-bank-account-s-dabringhaus-licatec.packinqsystems.de"
      },
      {
        "id": "",
        "name": "novatechies.cbg.ru"
      },
      {
        "id": "",
        "name": "docsecureatt-docdrive-filedoc.pages.dev"
      },
      {
        "id": "",
        "name": "aynures-newsletter.beehiiv.com"
      },
      {
        "id": "",
        "name": "2fwww.curiosolucky.com"
      },
      {
        "id": "",
        "name": "synthchromal.ru"
      },
      {
        "id": "",
        "name": "recambioselecue.ru"
      },
      {
        "id": "",
        "name": "pfremiumshirts.store"
      },
      {
        "id": "",
        "name": "lifestylesyncteche.pro"
      },
      {
        "id": "",
        "name": "googlevoicesecrets.com"
      },
      {
        "id": "",
        "name": "fruechtebox-expresszsnu.ru"
      },
      {
        "id": "",
        "name": "entertainmentcircuitss.ru"
      },
      {
        "id": "",
        "name": "entertaingadgetop.ru"
      },
      {
        "id": "",
        "name": "enterbuzztechscener.pl"
      },
      {
        "id": "",
        "name": "cyberdynalumeo.ru"
      },
      {
        "id": "",
        "name": "bytequestixo.pro"
      }
    ],
    "attack_patterns": [
      {
        "id": "5fbd38af-69a3-49b9-9ff4-e7ab3e59bd12",
        "name": "T1534"
      },
      {
        "id": "503ba2cd-0ae8-422c-8f1a-2cecb472db53",
        "name": "T1550.001"
      },
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ]
  },
  "external_refs": [
    "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rockstar-2fa-a-driving-force-in-phishing-as-a-service-paas/",
    "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rockstar-2fa-phishing-as-a-service-paas-noteworthy-email-campaigns/",
    "https://otx.alienvault.com/pulse/6750e1e2ad0568f66faeff19"
  ]
}