Social engineering campaign leveraging BPOs and support employees

Rafi Mahmood

• On 7 April, a researcher at Google Threat Intelligence Group (GTIG) reported they were tracking a financially motivated threat actor (UNC6783) targeting multiple sectors in social engineering campaigns, including Adobe.
• The actor has been observed compromising Business Process Outsourcers (BPOs) that work with the targeted companies, as well as their support and helpdesk employees directly, to gain trusted access and exfiltrate sensitive data.
• The campaigns leverage live chat with employees to direct them to fake helpdesk support domains which host malicious Okta login pages. Once authenticated, the actor then enrols their own devices as an MFA mechanism for persistent access.
• Organisations should ensure MFA devices are audited regularly, and implement phishing-resistant MFA (e.g. FIDO2 keys) where possible.

LinkedIn | Austin Larsen | #unc6783
X | International Cyber Digest | "🚨‼️ BREAKING: Adobe has been breached by threat actor..."