Thread by @JoeUchill

It's #shmoocon day 2 in Washington D.C. I'm at "Battling Supermutants in the Phishing Wasteland," which should be interesting, given that I've only lightly skirmished with regular mutants in the Phishing suburbs of Chicago.

(thred)

This will be a talk from @ZeroFox folks on modern fishing techniques.

@ZeroFOX Scratch that.
"This talk is not really about phishing but the economy behind it," Zach Allen, dir. threat intel of Zero Fox.

Also speaking is Ashlee Benge, who does threat intel at Zero Fox and is also an astrophysicist.

@ZeroFOX "It's not just usernames and passwords anymore."
A lot of account recovery for sensitive accounts now require selfie with visible ID.

@ZeroFOX Over time there have always been more google searches for malware than phishing. But google tracks more phishing sites than malware ones for safe browsing.

"Malware is always sexier than phishing."

@ZeroFOX They point to this @duosec graphic as a good explainer of phishing kits.
duo.com/assets/img/blo…

@ZeroFOX @duosec Naturally, that didn't unfurl.

@ZeroFOX @duosec They compare cybercrime to the disordered, patchwork economy of the game Fallout.

@ZeroFOX @duosec "Much like we've integrated into a platform economy, so has cybercrime."

@ZeroFOX @duosec Four basic pillars of phishing as a service:
--all services have a partner strategy, integrations, etc.
--pricing, packaging scheme
--as a service infrastructure. it's the only way to scale
--strong customer service/customer support infrastructure
#shmoocon

@ZeroFOX @duosec Actor named Cazanova Haxor has been operating since 2011 (for web defacements) but had designed first mass mailer since 2015. Web promotion infrastructure on Facebook by 2017, transitioned to Telegram in 2019 when Facebook banned him.

@ZeroFOX @duosec Telegram is not as interactive a platform in term of user engagement as Facebook was, limiting outreach.

Kits are roughly $99.

#shmoocon.

@ZeroFOX @duosec "We rarely see just phishing for credentials anymore" #shmoocon.

Last six months, roughly $24,000 in sales.

Cazanova Haxor has strong digital rights management - will only work on domains registered with the service. #shmoocon

"We really see an effort" for ease of use. If you can figure out how to open a terminal window, you can automate the entire web installation, including all dependencies.

#shmoocon #shmoocon2020

They made him a video game stat card
#shmoocon

Poor opsec common -- it's a tradeoff to market the product.

Caz was doxed in December.

Want a cheaper kit? How about 16Shop ($60 a kit, besides the new $110 amex kit)
#Shmoocon

Similar DRM scheme.

"This group does a better job of education," including good YouTube content. #Shmoocon.

Lots of kits have a hardcoded block list to prevent users.

Many now use a service called antibot[.]pw to do the blocking for them. #shmoocon

Here’s the 16shop stat card. Apologies for the low quality / bw images. I’m at a lousy angle to photo slides. #shmoocon