cyber.hendryadrian.com
Security News · thehackernews.com

Wazza Phishing Kit Uses Layered Routing to Target Organizations Across Three Regions

· Original article ↗

Summary

ANY.RUN reports that Wazza screens visitors through a multi-stage routing chain before serving an Adobe-themed Device Code phishing page, targeting banking, manufacturing, and government organizations in the US, Europe, and Australia.

Key points

  • Wazza checks campaign hostnames, issues a client marker and short-lived session token, and validates browser telemetry before delivering its phishing page.
  • The final lure is an Adobe-themed Device Code phishing page designed to target account authentication.
  • ANY.RUN identified activity targeting banking, manufacturing, and government organizations in the US, Europe, and Australia.
  • The routing and filtering may cause automated systems and analysts to see different content, complicating URL-based investigation.
  • The article recommends reproducing suspicious URL behavior in an isolated environment and using related indicators to investigate activity across customer environments.
  • The article presents sandboxing, threat-intelligence feeds, and security-platform integrations as ways for MSSPs to reuse investigation findings; these are ANY.RUN offerings.

Article Details

Event Type
Phishing campaign using the Wazza phishkit and multi-stage routing to selectively deliver an Adobe-themed Device Code phishing page.
Impact
The phishing page could persuade victims to complete an authentication action, potentially giving attackers access to an account or session. The article also describes potential operational costs for MSSPs, including longer investigations, unnecessary escalations, and reduced analyst capacity. No successful compromises or specific victim losses are reported.

Indicators of compromise

TypeIndicatorContext
DOMAINboegl-krysl[.]euWazza phishing infrastructure used to route visitors toward the final phishing page.
DOMAINcheck[.]boegl-krysl[.]euWazza validation host that checks the session token and browser telemetry before allowing visitors to continue.

Vendors

ANY.RUNANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. The campaign uses a multi-stage routing chain to screen visitors and

Products

Cortex XSOARANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.IBM QRadarANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.Microsoft DefenderANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.Microsoft SentinelANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.MISPANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.SplunkANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.TheHiveANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.Threat Intelligence Feeds (TI Feeds)ANY.RUN Threat Intelligence Feeds (TI Feeds) are designed to turn IOCs into continuous monitoring by streaming 99% unique, validated indicators and behavior-based threat data into security environments. The solutioonThreat Intelligence Lookup (TI Lookup)ANY.RUN Threat Intelligence Lookup (TI Lookup) provides another way to investigate these connections. Analysts can pivot from IOCs to related threat activity and use query updates to track changes over time.ThreatConnectANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.TinesANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.TorqANY.RUN provides integrations with platforms including Microsoft Sentinel, Microsoft Defender, Splunk, Cortex XSOAR, IBM QRadar, MISP, TheHive, ThreatConnect, Tines, Torq, and others.

Countries

Australianew phishkit targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. The campaign uses a multi-stage routing chain to screen visitors and automated traffic beforeUnited Statesidentified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. The campaign uses a multi-stage routing chain to screen visitors and automated

Industries

BankingANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. The campaign uses a multi-stage routing chain to screen visitors andGovernmentANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. The campaign uses a multi-stage routing chain to screen visitors andManaged security servicesManufacturingANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe, and Australia. The campaign uses a multi-stage routing chain to screen visitors and

Related Articles