cyber.hendryadrian.com
Threat Research · hunt.io

Open Directory Reveals Phishing Campaign Targeting Google and Naver Credentials

· Original article ↗

Summary

Hunt analyzed an open directory hosting Google and Naver phishing pages, a modified Xeno-RAT sample, and victim data. Infrastructure and tactics show overlaps with Kimsuky, though attribution remains uncertain.

Key points

  • The campaign used spoofed domains and crafted URL paths to host fake Google and Naver login pages that prompted users to re-enter credentials.
  • Google phishing pages used an iframe mimicking a temporary login error; the Naver page appeared unfinished.
  • An exposed upload directory contained a modified Xeno-RAT sample configured with the server's IP and port 4444.
  • The directory also exposed KakaoTalk chats, screenshots, and cryptocurrency transaction records.
  • Infrastructure and tactics overlapped with activity associated with Kimsuky, but the actor's identity was not confirmed.
  • Google Safe Browsing flagged the spoofed Binance site, after which the operators shifted to custom phishing paths.

Article Details

Attack Vectors
  • Phishing pages spoofing Google and Naver login experiences prompted users to re-enter credentials.
  • The campaign used crafted URL paths, redirects, and iframes to present fake login pages and transmit submitted credentials to attacker-controlled infrastructure.
  • A domain spoofing Binance was registered and used to host cloned content; after Google Safe Browsing marked the site malicious, the actor moved to targeted phishing pages.
  • A modified Xeno-RAT sample was found in the open directory. The article says it was configured to communicate with the directory's IP address on port 4444.
Defensive Notes
  • Remain vigilant for cloned websites, redirects, and login pages that request credentials after claiming a temporary communication error.
  • The article reports that Google Safe Browsing marked the spoofed site as malicious.

Indicators of compromise

TypeIndicatorContext
DOMAINbinace[.]homesSpoofed Binance domain used to host campaign content and phishing pages.
DOMAINgcuser[.]euDomain identified in the campaign's rewrite rules and infrastructure analysis.
DOMAINgduser[.]euDomain identified in the campaign's rewrite rules and infrastructure analysis.
DOMAINgeuser[.]euDomain listed as campaign infrastructure.
DOMAINghuser[.]euDomain listed as campaign infrastructure.
DOMAINgiuser[.]euDomain listed as campaign infrastructure.
DOMAINgjuser[.]euDomain listed as campaign infrastructure.
DOMAINhogmasil[.]lolDomain listed as campaign infrastructure.
DOMAINjandfolg[.]lolDomain listed as campaign infrastructure.
DOMAINkortiosdfp[.]lolDomain listed as campaign infrastructure.
DOMAINmasnail[.]shopCampaign domain hosting an open directory that mirrored phishing folders and iframes.
DOMAINmmori[.]lolDomain listed as campaign infrastructure.
DOMAINnaverscorp[.]shopDomain listed as campaign infrastructure associated with Naver-targeting phishing.
DOMAINnavincteam[.]shopDomain listed as campaign infrastructure associated with Naver-targeting phishing.
DOMAINncallserveiqnxme[.]storeDomain listed as campaign infrastructure associated with Naver-targeting phishing.
HOSTNAMEaccount[.]binace[.]homesSubdomain listed as campaign infrastructure.
HOSTNAMEccid[.]navincteam[.]shopSubdomain listed as campaign infrastructure.
HOSTNAMEgoto2corp[.]binace[.]homesSubdomain listed as campaign infrastructure.
HOSTNAMEkidsmanagement-pa[.]client6[.]binace[.]homesSubdomain listed as campaign infrastructure.
HOSTNAMEmil[.]masnail[.]shopSubdomain listed as campaign infrastructure.
HOSTNAMEnid[.]navincteam[.]shopSubdomain listed as campaign infrastructure.
HOSTNAMEpolicy[.]navincteam[.]shopSubdomain listed as campaign infrastructure.
HOSTNAMEsoundcaptchanidid[.]navincteam[.]shopSubdomain listed as campaign infrastructure.
HOSTNAMEstuff[.]gduser[.]euRewrite-rule destination host used to serve campaign content.
HOSTNAMEstuff[.]ilk[.]gduser[.]euExample host in the campaign's rewrite rules, which redirect requests to phishing content.
HOSTNAMEsupport[.]binace[.]homesSubdomain listed as campaign infrastructure.
HOSTNAMEworkspace[.]binace[.]homesSubdomain listed as campaign infrastructure.
HOSTNAMEwwwcorpid[.]navincteam[.]shopSubdomain listed as campaign infrastructure.
HOSTNAMEwwwid[.]navincteam[.]shopSubdomain listed as campaign infrastructure.
IPV4123[.]76[.]96[.]130IP address reported to resolve from gcuser[.]eu, which the article associates with the campaign.
IPV427[.]255[.]75[.]158IP address listed as campaign infrastructure.
IPV445[.]195[.]69[.]28IP address listed as campaign infrastructure.
URLhxxps[:]//binace[.]homes/middle/attach/PhishingURLPhishing link shown as the destination of the Naver iframe's login button.

MITRE ATT&CK

T1056.003 · Web Portal CaptureThe fake Google and Naver login pages prompted users to enter credentials, which the article says were transmitted to attacker-controlled infrastructure.

People

@asdasd13asbzPosted about a similar phishing open directory and identified a related spoofed Naver login page.Joe SlowikAuthored a 2022 post on domain hunting cited for identifying infrastructure patterns.x0rzAuthored a 2017 blog post cited for additional information about spoofed Gmail URL paths.

Threat Actors

APT43Named in the article as an alternate name for Kimsuky.Black BansheeNamed in the article as an alternate name for Kimsuky.KimsukyThe article reports overlaps between the campaign's infrastructure and TTPs and Kimsuky; the campaign itself is attributed only to a likely North Korean actor.ThalliumNamed in the article as an alternate name for Kimsuky.

Malware

Xeno-RATpages, the open directory that led us to this discovery also hosts a copy of the open-source malware, Xeno-RAT, and KakaoTalk chat logs between unknown individuals discussing cryptocurrency trading.

Products

BinanceThe actor first registered a domain spoofing cryptocurrency exchange Binance, then began to set up targeted phishing pages using iframes once Google Safe Browsing tagged the site as malicious.GoogleOver the past month, Hunt has tracked an ongoing phishing campaign by a likely North Korean threat actor focused on stealing Google and Naver credentials.KakaoTalkdirectory that led us to this discovery also hosts a copy of the open-source malware, Xeno-RAT, and KakaoTalk chat logs between unknown individuals discussing cryptocurrency trading.NaverOver the past month, Hunt has tracked an ongoing phishing campaign by a likely North Korean threat actor focused on stealing Google and Naver credentials.

Countries

JapanTelegram groups geared towards the same community. Within the same folder were transaction logs from a Japan-based digital currency company and screenshots from an unknown individual's cell phone and another'sNorth Koreaone with the commented-out name and possible Gmail address of an individual likely to be targeted by North Korea.South Korea

Industries

CryptocurrencyThe actor first registered a domain spoofing cryptocurrency exchange Binance, then began to set up targeted phishing pages using iframes once Google Safe Browsing tagged the site as malicious.

Related Articles