RH-ISAC Details CL-CRI-1116 Vishing and SaaS Extortion Campaign

Apr 23, 2026 · Original article ↗

Summary

RH-ISAC describes CL-CRI-1116 targeting retail and hospitality with vishing and SSO phishing to steal credentials, abuse SaaS access to locate and exfiltrate sensitive files, and extort victims; it recommends caller-verification policies, training and technical controls

Key points

The article says CL-CRI-1116 has targeted retail and hospitality organizations since February 2026, combining vishing that impersonates IT helpdesk staff with SSO phishing pages.
Operators reportedly use spoofed VoIP numbers or caller ID names to solicit credentials and TOTP codes, then register attacker-controlled devices to bypass MFA.
The campaign description says operators move from employee accounts toward privileged executive accounts using further social engineering.
The article describes abuse of Microsoft Graph API Sites.Read.All permissions and SaaS search, including Salesforce, to locate files containing terms such as “confidential” and “SSN.”
Reported exfiltration methods include browser downloads and API exports, with LimeWire or MEGA used to stage data; ransom demands are described as typically seven figures, with SWATting threats used as pressure.
RH-ISAC recommends caller identity verification, limits on information shared during calls, escalation procedures, simulation-based staff training, VoIP log analysis and MFA configuration.
The article provides a Python-requests user-agent and a list of IP indicators of compromise.

Article Details

Attack Vectors: CL-CRI-1116 uses phishing pages resembling corporate SSO sites to capture credentials and time-based one-time passwords.
The attackers use vishing from spoofed VoIP numbers or fraudulent Caller ID Names, often posing as IT support.
After compromising an employee account, they may register an attacker-controlled device to bypass MFA and use further social engineering to reach high-privileged executive accounts.
They abuse Microsoft Graph API permissions, including Sites.Read.All, and SaaS search functions such as Salesforce search to locate sensitive files.
They exfiltrate data through browser downloads or API exports and may stage it on file-sharing services such as LimeWire or MEGA.
The attackers send ransom demands, typically in the seven-figure range, and use SWATting threats against company personnel as additional pressure.
Defensive Notes: Review policies for verifying callers claiming to be IT support, including what information may be disclosed and which support actions require escalation.
Train frontline phone staff with simulations focused on social-engineering indicators such as vague answers to identity questions and pressure for immediate action.
Use VoIP log analysis and review MFA configurations as technical controls against vishing and account compromise.

Indicators of compromise

Type	Indicator	Context
IPV4	`111[.]235[.]93[.]125`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`112[.]207[.]101[.]227`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`112[.]207[.]108[.]30`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`112[.]209[.]151[.]78`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`119[.]111[.]248[.]227`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`136[.]158[.]24[.]160`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`136[.]158[.]27[.]101`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`136[.]158[.]27[.]72`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`136[.]32[.]210[.]197`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`136[.]35[.]103[.]90`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`146[.]70[.]172[.]228`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`179[.]43[.]185[.]226`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`184[.]93[.]0[.]17`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`185[.]193[.]127[.]130`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`185[.]231[.]33[.]62`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`199[.]127[.]61[.]200`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`208[.]131[.]130[.]67`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`24[.]177[.]37[.]97`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`35[.]139[.]72[.]161`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`37[.]19[.]210[.]9`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.
IPV4	`72[.]180[.]124[.]192`	Listed in the article's Indicators of Compromise section for the reported activity; its specific role is not stated.