If you think AI and deepfakes are THE name of the game in "sophisticated" social engineering attacks, think again. AI-generated deepfakes are often just one step (a final blow) in a larger social engineering kill-chain.
In this week's social engineering case, we see a layered intrusion involving a compromised Telegram account, a fake Zoom meeting, a ClickFix-style infection vector and, as a last step, an AI-generated video.
๐๐ก๐๐ญ ๐ก๐๐ฉ๐ฉ๐๐ง๐๐?
๐ธ The threat actor initiates contact with a specific victim via Telegram, using a legitimate but compromised account of an executive, to leverage existing trust.
๐ธ After building rapport through industry-specific conversation, the actor invites the victim to a call, and sends a Calendly link to schedule it.
๐ธ The Calendly link redirects to a spoofed Zoom meeting hosted on the threat actor's infrastructure: zoom[.]uswe05[.]us
๐๐ฉ๐ช๐ด ๐ช๐ด ๐ต๐ฉ๐ฆ ๐ง๐ช๐ณ๐ด๐ต ๐ฐ๐ฃ๐ท๐ช๐ฐ๐ถ๐ด ๐ณ๐ฆ๐ฅ ๐ง๐ญ๐ข๐จ ๐ต๐ฉ๐ข๐ต *๐ค๐ฐ๐ถ๐ญ๐ฅ* ๐ฉ๐ข๐ท๐ฆ ๐ฃ๐ฆ๐ฆ๐ฏ ๐ด๐ฑ๐ฐ๐ต๐ต๐ฆ๐ฅ.
๐๐ถ๐ต, ๐ธ๐ฉ๐ฆ๐ฏ ๐ข ๐ต๐ฉ๐ณ๐ฆ๐ข๐ต ๐ข๐ค๐ต๐ฐ๐ณ ๐ต๐ข๐ฌ๐ฆ๐ด ๐ต๐ฉ๐ฆ ๐ต๐ช๐ฎ๐ฆ ๐ต๐ฐ ๐ฃ๐ถ๐ช๐ญ๐ฅ ๐ต๐ณ๐ถ๐ด๐ต ๐ธ๐ช๐ต๐ฉ ๐ข ๐ต๐ข๐ณ๐จ๐ฆ๐ต ๐ง๐ช๐ณ๐ด๐ต, ๐ต๐ฉ๐ฆ ๐ต๐ณ๐ถ๐ด๐ต-๐ต๐ณ๐ข๐ฏ๐ด๐ง๐ฆ๐ณ๐ฆ๐ฏ๐ค๐ฆ ๐ฎ๐ฆ๐ค๐ฉ๐ข๐ฏ๐ช๐ด๐ฎ ๐ฌ๐ช๐ค๐ฌ๐ด ๐ช๐ฏ. ๐๐ฏ๐ฅ ๐ต๐ฉ๐ฆ๐ฏ, ๐ต๐ฉ๐ฆ ๐ญ๐ช๐ต๐ต๐ญ๐ฆ ๐ณ๐ฆ๐ฅ ๐ง๐ญ๐ข๐จ๐ด ๐ต๐ฉ๐ข๐ต ๐ง๐ฐ๐ญ๐ญ๐ฐ๐ธ ๐ต๐ฆ๐ฏ๐ฅ ๐ต๐ฐ ๐จ๐ฆ๐ต ๐ฐ๐ท๐ฆ๐ณ๐ญ๐ฐ๐ฐ๐ฌ๐ฆ๐ฅ. ๐๐ด ๐ต๐ฉ๐ฆ๐บ ๐ฅ๐ช๐ฅ.
๐ธ The call begins. The victim sees the video of a CEO from another company. Or, purportedly, their deepfake version.
๐ธ And then hey, "the audio is broken!". If only that could quickly get fixed...there are only 20 minutes left in the call.
This is where the ClickFix-style social engineering begins. The the threat actor directs the victim to run troubleshooting commands on their system to fix the issue.
๐ธ Embedded within the string of commands is a single command that initiates a multi-stage infection chain, ultimately deploying 7 distinct malware families (described in the report).
"Proven play? Replay".
This is not a one time hit. Mandiant has observed UNC1069 using these techniques to target both corporate entities and individuals within the cryptocurrency industry, as well as venture capital firms and their employees or executives. The list will expand.
Sophisticated social engineering attacks remain the ones that contain multiple elaborate steps that eventually build on each other to make the scheme work.
Full report:
https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering
#socialengineering #deepfakes #infosec #threatintelligence