{
  "name": "Unmasking Phishing: Strategies for identifying 0ktapus domains and beyond",
  "slug": "unmasking-phishing-strategies-for-identifying-0ktapus-domains-and-beyond",
  "description": "This analysis examines phishing tactics used by threat actors, particularly focusing on the 0ktapus group. It outlines techniques for investigating phishing campaigns by pivoting between landing pages, using 0ktapus as a case study. The methods discussed include application fingerprinting, network profiling, and domain registration analysis. The research reveals various DOM templates used by 0ktapus over time and provides insights into their infrastructure and tactics. The article also offers recommendations for prevention and detection of phishing attacks, emphasizing the importance of MFA, SSO, and continuous vigilance in cybersecurity practices.",
  "published": "2024-11-07T16:32:28+00:00",
  "created_at": "2024-11-07T16:32:28+00:00",
  "modified_at": "2024-11-07T20:58:19+00:00",
  "created_at_opencti": "2024-11-07T16:32:28+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-11-07",
    "identity theft",
    "phishing",
    "social engineering"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "80.78.28.234"
      },
      {
        "id": "",
        "name": "80.78.24.166"
      },
      {
        "id": "",
        "name": "80.78.25.254"
      },
      {
        "id": "",
        "name": "80.78.22.244"
      },
      {
        "id": "",
        "name": "67.217.228.42"
      },
      {
        "id": "",
        "name": "64.95.13.215"
      },
      {
        "id": "",
        "name": "216.245.184.53"
      },
      {
        "id": "",
        "name": "193.149.176.19"
      },
      {
        "id": "",
        "name": "162.33.179.76"
      },
      {
        "id": "",
        "name": "80.78.24.176"
      },
      {
        "id": "",
        "name": "www.validin.com"
      },
      {
        "id": "",
        "name": "www.silentpush.com"
      },
      {
        "id": "",
        "name": "www.cyberresilience.com"
      },
      {
        "id": "",
        "name": "https://www.cyberresilience.com/threatonomics/resilience-threat-researchers-identify-new-campaigns-from-scattered-spider/"
      },
      {
        "id": "",
        "name": "https://www.validin.com/blog/coralling-scattered-spider-with-dns-history/"
      },
      {
        "id": "",
        "name": "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud"
      },
      {
        "id": "",
        "name": "https://blog.sekoia.io/scattered-spider-laying-new-eggs/"
      },
      {
        "id": "",
        "name": "https://blog.eclecticiq.com/ransomware-in-the-cloud-scattered-spider-targeting-insurance-and-financial-industries"
      },
      {
        "id": "",
        "name": "www.authenticate-bt.com"
      },
      {
        "id": "",
        "name": "www.dashsso.com"
      },
      {
        "id": "",
        "name": "https://www.silentpush.com/blog/scattered-spider/"
      },
      {
        "id": "",
        "name": "ns3.my-ndns.com"
      },
      {
        "id": "",
        "name": "att-mfa.com"
      },
      {
        "id": "",
        "name": "mailgun-okta.com"
      },
      {
        "id": "",
        "name": "tickets.zapto.org"
      },
      {
        "id": "",
        "name": "sso.ibexgiobal.com"
      },
      {
        "id": "",
        "name": "rbx.okta.bio"
      },
      {
        "id": "",
        "name": "ping.taskus-sso.com"
      },
      {
        "id": "",
        "name": "okta.cellularsaies.com"
      },
      {
        "id": "",
        "name": "louisvuitton.okta-lv.com"
      },
      {
        "id": "",
        "name": "login.unumhr.com"
      },
      {
        "id": "",
        "name": "login.transamerica-hr.com"
      },
      {
        "id": "",
        "name": "login.thrivent-hr.com"
      },
      {
        "id": "",
        "name": "login.unum-hr.com"
      },
      {
        "id": "",
        "name": "login.synchronyfinanciai.com"
      },
      {
        "id": "",
        "name": "login.servicenow-help.com"
      },
      {
        "id": "",
        "name": "login.securian-hr.com"
      },
      {
        "id": "",
        "name": "login.realogy-hr.com"
      },
      {
        "id": "",
        "name": "login.rbx-hr.com"
      },
      {
        "id": "",
        "name": "login.nfp-hr.com"
      },
      {
        "id": "",
        "name": "login.klaviyo-hr.com"
      },
      {
        "id": "",
        "name": "login.hr-intercom.com"
      },
      {
        "id": "",
        "name": "login.grubhub-support.com"
      },
      {
        "id": "",
        "name": "login.doordash-support.com"
      },
      {
        "id": "",
        "name": "login.corporate-pnc.com"
      },
      {
        "id": "",
        "name": "login.corporate-ally.com"
      },
      {
        "id": "",
        "name": "login.block-hr.com"
      },
      {
        "id": "",
        "name": "login.ally-hr.com"
      },
      {
        "id": "",
        "name": "account.securian-hr.com"
      },
      {
        "id": "",
        "name": "account.klaviyo-hr.com"
      },
      {
        "id": "",
        "name": "account.kemper-support.com"
      },
      {
        "id": "",
        "name": "ziffdavis-okta.com"
      },
      {
        "id": "",
        "name": "zendesk-servicedesk.com"
      },
      {
        "id": "",
        "name": "xapo-okta.com"
      },
      {
        "id": "",
        "name": "verify-tmobile.com"
      },
      {
        "id": "",
        "name": "verify-mailgun.com"
      },
      {
        "id": "",
        "name": "uscc-hr.com"
      },
      {
        "id": "",
        "name": "unchainedprod-okta.com"
      },
      {
        "id": "",
        "name": "ultainternal.com"
      },
      {
        "id": "",
        "name": "ultahub.com"
      },
      {
        "id": "",
        "name": "typeform-okta.com"
      },
      {
        "id": "",
        "name": "twillio-sendgrid.com"
      },
      {
        "id": "",
        "name": "twitter-okta.com"
      },
      {
        "id": "",
        "name": "telint-helpdesk.com"
      },
      {
        "id": "",
        "name": "teleperformance-incident.com"
      },
      {
        "id": "",
        "name": "t-mobile-okta.com"
      },
      {
        "id": "",
        "name": "t-mobiie.net"
      },
      {
        "id": "",
        "name": "sync-apple.com"
      },
      {
        "id": "",
        "name": "sunrise-crypto.com"
      },
      {
        "id": "",
        "name": "storewatch-tmobile.com"
      },
      {
        "id": "",
        "name": "stargatesso.com"
      },
      {
        "id": "",
        "name": "stargatesso-gemini.com"
      },
      {
        "id": "",
        "name": "stargate-okta.com"
      },
      {
        "id": "",
        "name": "sso-klaviyo.com"
      },
      {
        "id": "",
        "name": "sso-falconx.com"
      },
      {
        "id": "",
        "name": "squarespacehr.com"
      },
      {
        "id": "",
        "name": "squarespace-okta.com"
      },
      {
        "id": "",
        "name": "snapchat-okta.com"
      },
      {
        "id": "",
        "name": "settings-okta.com"
      },
      {
        "id": "",
        "name": "sessions-sendgrid.com"
      },
      {
        "id": "",
        "name": "servicenowprod.com"
      },
      {
        "id": "",
        "name": "sendgrid-overview.com"
      },
      {
        "id": "",
        "name": "sendgrid-account.com"
      },
      {
        "id": "",
        "name": "robinhood-servicedesk.com"
      },
      {
        "id": "",
        "name": "ripple-okta.com"
      },
      {
        "id": "",
        "name": "review-mailgun.com"
      },
      {
        "id": "",
        "name": "resolveservicedesk.com"
      },
      {
        "id": "",
        "name": "rejectauth-sendgrid.com"
      },
      {
        "id": "",
        "name": "rbx-servicedesk.com"
      },
      {
        "id": "",
        "name": "rbx-corp.com"
      },
      {
        "id": "",
        "name": "rbx-hr.com"
      },
      {
        "id": "",
        "name": "prntsrc.net"
      },
      {
        "id": "",
        "name": "pfchangs-support.com"
      },
      {
        "id": "",
        "name": "paxos-okta.com"
      },
      {
        "id": "",
        "name": "ouryahoo-okta.net"
      },
      {
        "id": "",
        "name": "ouryahoo-okta.org"
      },
      {
        "id": "",
        "name": "ouryahoo-okta.com"
      },
      {
        "id": "",
        "name": "okta-verify.com"
      },
      {
        "id": "",
        "name": "onsolve-okta.com"
      },
      {
        "id": "",
        "name": "okta-twilio.com"
      },
      {
        "id": "",
        "name": "okta-ouryahoo.com"
      },
      {
        "id": "",
        "name": "okta-ripple.com"
      },
      {
        "id": "",
        "name": "okta-onsolve.com"
      },
      {
        "id": "",
        "name": "okta-nydig.com"
      },
      {
        "id": "",
        "name": "okta-intercom.com"
      },
      {
        "id": "",
        "name": "okta-gamestop.com"
      },
      {
        "id": "",
        "name": "okta-campaignmonitor.com"
      },
      {
        "id": "",
        "name": "okta-cbhq.net"
      },
      {
        "id": "",
        "name": "okta-blockdaemon.com"
      },
      {
        "id": "",
        "name": "nike-support.com"
      },
      {
        "id": "",
        "name": "mixpanel-okta.com"
      },
      {
        "id": "",
        "name": "mgmresorts-okta.com"
      },
      {
        "id": "",
        "name": "mcointernal-okta.com"
      },
      {
        "id": "",
        "name": "markel-hr.com"
      },
      {
        "id": "",
        "name": "manageactivity-sendgrid.com"
      },
      {
        "id": "",
        "name": "luno-okta.com"
      },
      {
        "id": "",
        "name": "louisvuitton-okta.com"
      },
      {
        "id": "",
        "name": "klaviyo-vpn.com"
      },
      {
        "id": "",
        "name": "klav-workday.com"
      },
      {
        "id": "",
        "name": "jacksonhewitt-service.com"
      },
      {
        "id": "",
        "name": "itbit-okta.com"
      },
      {
        "id": "",
        "name": "intercom-okta.com"
      },
      {
        "id": "",
        "name": "intercom-hr.com"
      },
      {
        "id": "",
        "name": "hr-gnc.com"
      },
      {
        "id": "",
        "name": "grubhub-support.com"
      },
      {
        "id": "",
        "name": "grid-review.com"
      },
      {
        "id": "",
        "name": "gofundme-okta.com"
      },
      {
        "id": "",
        "name": "grayscale-okta.com"
      },
      {
        "id": "",
        "name": "gd-okta.com"
      },
      {
        "id": "",
        "name": "galaxy-okta.com"
      },
      {
        "id": "",
        "name": "five9-hr.com"
      },
      {
        "id": "",
        "name": "fico-servicenow.com"
      },
      {
        "id": "",
        "name": "expediagroup-servicenow.com"
      },
      {
        "id": "",
        "name": "epic-servicedesk.com"
      },
      {
        "id": "",
        "name": "docusignhq.net"
      },
      {
        "id": "",
        "name": "docusign-okta.com"
      },
      {
        "id": "",
        "name": "dashboard-mailgun.com"
      },
      {
        "id": "",
        "name": "corp-foundever.net"
      },
      {
        "id": "",
        "name": "corescientific-okta.com"
      },
      {
        "id": "",
        "name": "contact-sendgrid.com"
      },
      {
        "id": "",
        "name": "consensys-okta.com"
      },
      {
        "id": "",
        "name": "condenast-hub-okta-emea.com"
      },
      {
        "id": "",
        "name": "concentrix-servicedesk.com"
      },
      {
        "id": "",
        "name": "commonspiritcorp-okta.com"
      },
      {
        "id": "",
        "name": "calendar-dd.com"
      },
      {
        "id": "",
        "name": "block-hr.com"
      },
      {
        "id": "",
        "name": "binance-us-okta.com"
      },
      {
        "id": "",
        "name": "binance-sso.com"
      },
      {
        "id": "",
        "name": "auth-alchemy.com"
      },
      {
        "id": "",
        "name": "apple-vpn.com"
      },
      {
        "id": "",
        "name": "alchemy-okta.com"
      },
      {
        "id": "",
        "name": "adasupport-okta.com"
      },
      {
        "id": "",
        "name": "activecampainhr.com"
      },
      {
        "id": "",
        "name": "acwa-internal.com"
      },
      {
        "id": "",
        "name": "acwa-apple.com"
      },
      {
        "id": "",
        "name": "account-sendgrid.com"
      },
      {
        "id": "",
        "name": "login.five9-hr.com"
      },
      {
        "id": "",
        "name": "login.uscc-hr.com"
      },
      {
        "id": "",
        "name": "revolut-ticket.com"
      },
      {
        "id": "",
        "name": "forward-icloud.com"
      },
      {
        "id": "",
        "name": "blog.sekoia.io"
      },
      {
        "id": "",
        "name": "login.suniife.com"
      },
      {
        "id": "",
        "name": "vzapps-vzn.com"
      },
      {
        "id": "",
        "name": "uscellular-sso.com"
      },
      {
        "id": "",
        "name": "unumhr.com"
      },
      {
        "id": "",
        "name": "transamerica-hr.com"
      },
      {
        "id": "",
        "name": "thrivent-hr.com"
      },
      {
        "id": "",
        "name": "telesignhr.com"
      },
      {
        "id": "",
        "name": "supporthub-iqor.com"
      },
      {
        "id": "",
        "name": "stargate-sso.com"
      },
      {
        "id": "",
        "name": "squarespace-hr.com"
      },
      {
        "id": "",
        "name": "sharing-folders.com"
      },
      {
        "id": "",
        "name": "roblox-hrs.com"
      },
      {
        "id": "",
        "name": "rbxhr.net"
      },
      {
        "id": "",
        "name": "podium-hr.com"
      },
      {
        "id": "",
        "name": "nfp-hr.com"
      },
      {
        "id": "",
        "name": "newyorklifehr.com"
      },
      {
        "id": "",
        "name": "mercury-hr.com"
      },
      {
        "id": "",
        "name": "mutualofomaha-hr.com"
      },
      {
        "id": "",
        "name": "klaviyo-hr.com"
      },
      {
        "id": "",
        "name": "ibexgiobal.com"
      },
      {
        "id": "",
        "name": "hanover-hr.com"
      },
      {
        "id": "",
        "name": "grubhubsso.com"
      },
      {
        "id": "",
        "name": "gemini-sso.com"
      },
      {
        "id": "",
        "name": "foundever-sso.com"
      },
      {
        "id": "",
        "name": "corporate-huntington.com"
      },
      {
        "id": "",
        "name": "corporate-ally.com"
      },
      {
        "id": "",
        "name": "corp-foundever.com"
      },
      {
        "id": "",
        "name": "corp-cox.com"
      },
      {
        "id": "",
        "name": "connect-asurion.net"
      },
      {
        "id": "",
        "name": "clicksend-staging.com"
      },
      {
        "id": "",
        "name": "cinfin-hr.com"
      },
      {
        "id": "",
        "name": "cellularsaies.com"
      },
      {
        "id": "",
        "name": "block-sso.com"
      },
      {
        "id": "",
        "name": "amica-hr.com"
      },
      {
        "id": "",
        "name": "ally-hr.com"
      },
      {
        "id": "",
        "name": "activecampaignhr.com"
      },
      {
        "id": "",
        "name": "activecampaign-hr.com"
      },
      {
        "id": "",
        "name": "klaviyocorp.net"
      },
      {
        "id": "",
        "name": "intercomsso.net"
      }
    ],
    "intrusion_sets": [
      {
        "id": "b2c5d4ba-3385-4481-9ece-1bb28d4d6d9b",
        "name": "0ktapus",
        "slug": "0ktapus"
      }
    ],
    "attack_patterns": [
      {
        "id": "ab179192-1c1a-4b7d-9792-b608a9459b71",
        "name": "T1591"
      },
      {
        "id": "3528fd00-a96d-42d8-80ac-95b1e980ab8b",
        "name": "T1606"
      },
      {
        "id": "75702b35-b790-4504-a1e0-7829e76f22e9",
        "name": "T1585"
      },
      {
        "id": "2969e5a7-1049-4df8-b1ba-8a0675de6b94",
        "name": "T1589"
      },
      {
        "id": "6babd5aa-5112-4f14-a660-60d756a65d6d",
        "name": "T1586"
      },
      {
        "id": "9c5a20d1-0df9-4e99-bcc5-0b731a78b5d1",
        "name": "T1608"
      },
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "c340d47a-2ea8-41ca-9a0b-a72559b89bbf",
        "name": "T1584"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Telecommunications"
      }
    ]
  },
  "external_refs": [
    "https://www.wiz.io/blog/unmasking-phishing-strategies-for-identifying-0ktapus-domains",
    "https://otx.alienvault.com/pulse/672cf9acd2742762e7b47903"
  ]
}