Trusted Design

Spear Phishing Campaign Using “Sign in” Themed Emails Designed to Harvest User Credentials

概要

US-CERT received information from a trusted third-party of a spear phishing campaign using “sign in” themed emails containing malicious links designed to harvest user credentials. According to the trusted third party, suspected intrusion set actors used the "shortme.org" URL shortening service to obfuscate malicious links embedded within emails. The spoofed links appear to be from Yahoo and Gmail email security. The email contains a spoofed unauthorized log-in attempt message to entice the victim to change their password using the embedded link. If successful, the victim will click the link and navigate to the "shortme[.]org" site, hosted at IP address "191.101.31[.]253". The shortened URL would immediately be redirected to a malicious U.S. domain hosted at an unspecified U.S. IP address.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

Phishing email - Credential Harvesting Subject" Quick Response"! (score: 0.71)
NCCIC / US-CERT: Malware Initial Findings Report (MIFR) - 10131540 (score: 0.71)
"Notice" - Phishing Email (score: 0.67)
Phishing campaign from ambercapitalllc.com (score: 0.67)
Google Credential Phishing on serverfortechhelp[.]com (score: 0.67)

このPulseに関連する脅威アクター (事実ベース)

Scattered Spider

Score: 30.26

Matched TTPs:

T1564.008 - Email Hiding Rules
T1598.003 - Spearphishing Link
T1598.004 - Spearphishing Voice
T1588.001 - Malware
T1204 - User Execution
T1585.001 - Social Media Accounts
T1656 - Impersonation
T1598 - Phishing for Information
T1578.002 - Create Cloud Instance

MITREへのリンク →

FIN4

Score: 6.94

Matched TTPs:

T1564.008 - Email Hiding Rules
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

LuminousMoth

Score: 9.11

Matched TTPs:

T1566.002 - Spearphishing Link
T1588.001 - Malware
T1608.005 - Link Target
T1204.001 - Malicious Link

MITREへのリンク →

Kimsuky

Score: 36.56

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1586.002 - Email Accounts
T1585.002 - Email Accounts
T1534 - Internal Spearphishing
T1566 - Phishing
T1585.001 - Social Media Accounts
T1656 - Impersonation
T1598 - Phishing for Information
T1070.004 - File Deletion
T1204.001 - Malicious Link
T1102.001 - Dead Drop Resolver
T1584.001 - Domains
T1078.003 - Local Accounts

MITREへのリンク →

Sidewinder

Score: 8.89

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1598.002 - Spearphishing Attachment
T1204.001 - Malicious Link

MITREへのリンク →

FIN7

Score: 9.32

Matched TTPs:

T1566.002 - Spearphishing Link
T1608.005 - Link Target
T1204.001 - Malicious Link
T1078.003 - Local Accounts

MITREへのリンク →

Mustard Tempest

Score: 6.09

Matched TTPs:

T1566.002 - Spearphishing Link
T1204.001 - Malicious Link
T1584.001 - Domains

MITREへのリンク →

Sandworm Team

Score: 11.27

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1585.002 - Email Accounts
T1585.001 - Social Media Accounts
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

Transparent Tribe

Score: 6.09

Matched TTPs:

T1566.002 - Spearphishing Link
T1204.001 - Malicious Link
T1584.001 - Domains

MITREへのリンク →

Evilnum

Score: 4.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

Mustang Panda

Score: 11.60

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1586.002 - Email Accounts
T1585.002 - Email Accounts
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

FIN8

Score: 4.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

APT32

Score: 15.50

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1550.003 - Pass the Ticket
T1585.001 - Social Media Accounts
T1070.004 - File Deletion
T1204.001 - Malicious Link
T1078.003 - Local Accounts

MITREへのリンク →

APT3

Score: 4.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

APT1

Score: 9.48

Matched TTPs:

T1566.002 - Spearphishing Link
T1585.002 - Email Accounts
T1588.001 - Malware
T1584.001 - Domains

MITREへのリンク →

Lazarus Group

Score: 14.11

Matched TTPs:

T1566.002 - Spearphishing Link
T1218 - System Binary Proxy Execution
T1585.002 - Email Accounts
T1585.001 - Social Media Accounts
T1070.004 - File Deletion
T1566.003 - Spearphishing via Service

MITREへのリンク →

Leviathan

Score: 13.72

Matched TTPs:

T1566.002 - Spearphishing Link
T1586.002 - Email Accounts
T1585.002 - Email Accounts
T1534 - Internal Spearphishing
T1585.001 - Social Media Accounts
T1204.001 - Malicious Link

MITREへのリンク →

ZIRCONIUM

Score: 8.70

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1598 - Phishing for Information
T1204.001 - Malicious Link

MITREへのリンク →

EXOTIC LILY

Score: 9.96

Matched TTPs:

T1566.002 - Spearphishing Link
T1585.002 - Email Accounts
T1585.001 - Social Media Accounts
T1204.001 - Malicious Link
T1566.003 - Spearphishing via Service

MITREへのリンク →

Magic Hound

Score: 19.75

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1586.002 - Email Accounts
T1585.002 - Email Accounts
T1585.001 - Social Media Accounts
T1070.004 - File Deletion
T1204.001 - Malicious Link
T1566.003 - Spearphishing via Service
T1584.001 - Domains

MITREへのリンク →

OilRig

Score: 13.00

Matched TTPs:

T1566.002 - Spearphishing Link
T1586.002 - Email Accounts
T1555.004 - Windows Credential Manager
T1070.004 - File Deletion
T1204.001 - Malicious Link
T1566.003 - Spearphishing via Service

MITREへのリンク →

Windshift

Score: 5.33

Matched TTPs:

T1566.002 - Spearphishing Link
T1204.001 - Malicious Link
T1566.003 - Spearphishing via Service

MITREへのリンク →

Cobalt Group

Score: 4.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

APT29

Score: 20.43

Matched TTPs:

T1566.002 - Spearphishing Link
T1586.002 - Email Accounts
T1550.003 - Pass the Ticket
T1090.004 - Domain Fronting
T1070.004 - File Deletion
T1204.001 - Malicious Link
T1566.003 - Spearphishing via Service
T1078.003 - Local Accounts

MITREへのリンク →

TA2541

Score: 5.27

Matched TTPs:

T1566.002 - Spearphishing Link
T1588.001 - Malware
T1204.001 - Malicious Link

MITREへのリンク →

Earth Lusca

Score: 9.11

Matched TTPs:

T1566.002 - Spearphishing Link
T1098.004 - SSH Authorized Keys
T1588.001 - Malware
T1204.001 - Malicious Link

MITREへのリンク →

RedCurl

Score: 4.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

Storm-1811

Score: 11.54

Matched TTPs:

T1566.002 - Spearphishing Link
T1566.004 - Spearphishing Voice
T1656 - Impersonation
T1566.003 - Spearphishing via Service

MITREへのリンク →

Turla

Score: 11.55

Matched TTPs:

T1566.002 - Spearphishing Link
T1588.001 - Malware
T1555.004 - Windows Credential Manager
T1204.001 - Malicious Link
T1078.003 - Local Accounts

MITREへのリンク →

Wizard Spider

Score: 10.10

Matched TTPs:

T1566.002 - Spearphishing Link
T1585.002 - Email Accounts
T1555.004 - Windows Credential Manager
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

TA577

Score: 5.47

Matched TTPs:

T1566.002 - Spearphishing Link
T1586.002 - Email Accounts
T1204.001 - Malicious Link

MITREへのリンク →

Patchwork

Score: 9.93

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1070.004 - File Deletion
T1204.001 - Malicious Link
T1102.001 - Dead Drop Resolver

MITREへのリンク →

TA505

Score: 5.27

Matched TTPs:

T1566.002 - Spearphishing Link
T1588.001 - Malware
T1204.001 - Malicious Link

MITREへのリンク →

LazyScripter

Score: 5.27

Matched TTPs:

T1566.002 - Spearphishing Link
T1588.001 - Malware
T1204.001 - Malicious Link

MITREへのリンク →

APT42

Score: 6.77

Matched TTPs:

T1566.002 - Spearphishing Link
T1585.002 - Email Accounts
T1656 - Impersonation

MITREへのリンク →

APT39

Score: 4.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

Silent Librarian

Score: 8.59

Matched TTPs:

T1598.003 - Spearphishing Link
T1585.002 - Email Accounts
T1608.005 - Link Target

MITREへのリンク →

APT28

Score: 24.11

Matched TTPs:

T1598.003 - Spearphishing Link
T1586.002 - Email Accounts
T1598 - Phishing for Information
T1070.004 - File Deletion
T1498 - Network Denial of Service
T1204.001 - Malicious Link
T1550.001 - Application Access Token
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

Star Blizzard

Score: 13.37

Matched TTPs:

T1598.003 - Spearphishing Link
T1586.002 - Email Accounts
T1585.002 - Email Accounts
T1598.002 - Spearphishing Attachment
T1585.001 - Social Media Accounts

MITREへのリンク →

Moonstone Sleet

Score: 13.05

Matched TTPs:

T1598.003 - Spearphishing Link
T1585.002 - Email Accounts
T1585.001 - Social Media Accounts
T1598 - Phishing for Information
T1566.003 - Spearphishing via Service

MITREへのリンク →

CURIUM

Score: 9.61

Matched TTPs:

T1598.003 - Spearphishing Link
T1585.002 - Email Accounts
T1585.001 - Social Media Accounts
T1566.003 - Spearphishing via Service

MITREへのリンク →

Dragonfly

Score: 7.46

Matched TTPs:

T1598.003 - Spearphishing Link
T1598.002 - Spearphishing Attachment
T1070.004 - File Deletion

MITREへのリンク →

HEXANE

Score: 10.92

Matched TTPs:

T1586.002 - Email Accounts
T1585.002 - Email Accounts
T1534 - Internal Spearphishing
T1585.001 - Social Media Accounts

MITREへのリンク →

LAPSUS$

Score: 20.56

Matched TTPs:

T1586.002 - Email Accounts
T1598.004 - Spearphishing Voice
T1588.001 - Malware
T1204 - User Execution
T1656 - Impersonation
T1578.002 - Create Cloud Instance

MITREへのリンク →

Volt Typhoon

Score: 9.65

Matched TTPs:

T1218 - System Binary Proxy Execution
T1614 - System Location Discovery
T1070.004 - File Deletion

MITREへのリンク →

Medusa Group

Score: 10.55

Matched TTPs:

T1585.002 - Email Accounts
T1585.001 - Social Media Accounts
T1070.004 - File Deletion
T1218.014 - MMC

MITREへのリンク →

Contagious Interview

Score: 12.93

Matched TTPs:

T1585.002 - Email Accounts
T1585.001 - Social Media Accounts
T1656 - Impersonation
T1070.004 - File Deletion
T1204.001 - Malicious Link
T1566.003 - Spearphishing via Service

MITREへのリンク →

Salt Typhoon

Score: 3.84

Matched TTPs:

T1098.004 - SSH Authorized Keys

MITREへのリンク →

TeamTNT

Score: 5.23

Matched TTPs:

T1098.004 - SSH Authorized Keys
T1070.004 - File Deletion

MITREへのリンク →

Ember Bear

Score: 3.84

Matched TTPs:

T1588.001 - Malware
T1070.004 - File Deletion

MITREへのリンク →

Metador

Score: 3.84

Matched TTPs:

T1588.001 - Malware
T1070.004 - File Deletion

MITREへのリンク →

Aquatic Panda

Score: 3.84

Matched TTPs:

T1588.001 - Malware
T1070.004 - File Deletion

MITREへのリンク →

UNC3886

Score: 3.84

Matched TTPs:

T1588.001 - Malware
T1070.004 - File Deletion

MITREへのリンク →

BRONZE BUTLER

Score: 8.51

Matched TTPs:

T1550.003 - Pass the Ticket
T1070.004 - File Deletion
T1102.001 - Dead Drop Resolver

MITREへのリンク →

SideCopy

Score: 11.04

Matched TTPs:

T1598.002 - Spearphishing Attachment
T1614 - System Location Discovery
T1584.001 - Domains

MITREへのリンク →

Gamaredon Group

Score: 6.36

Matched TTPs:

T1534 - Internal Spearphishing
T1070.004 - File Deletion
T1204.001 - Malicious Link

MITREへのリンク →

INC Ransom

Score: 4.67

Matched TTPs:

T1566 - Phishing
T1070.004 - File Deletion

MITREへのリンク →

Sea Turtle

Score: 5.95

Matched TTPs:

T1566 - Phishing
T1078.003 - Local Accounts

MITREへのリンク →

Axiom

Score: 12.36

Matched TTPs:

T1566 - Phishing
T1553 - Subvert Trust Controls
T1001.002 - Steganography

MITREへのリンク →

AppleJeus

Score: 3.29

Matched TTPs:

T1566 - Phishing

MITREへのリンク →

GOLD SOUTHFIELD

Score: 3.29

Matched TTPs:

T1566 - Phishing

MITREへのリンク →

Saint Bear

Score: 4.39

Matched TTPs:

T1656 - Impersonation
T1204.001 - Malicious Link

MITREへのリンク →

APT41

Score: 7.70

Matched TTPs:

T1656 - Impersonation
T1070.004 - File Deletion
T1102.001 - Dead Drop Resolver

MITREへのリンク →

Stealth Falcon

Score: 3.62

Matched TTPs:

T1555.004 - Windows Credential Manager

MITREへのリンク →

FIN10

Score: 4.05

Matched TTPs:

T1070.004 - File Deletion
T1078.003 - Local Accounts

MITREへのリンク →

Tropic Trooper

Score: 4.05

Matched TTPs:

T1070.004 - File Deletion
T1078.003 - Local Accounts

MITREへのリンク →

APT38

Score: 7.28

Matched TTPs:

T1070.004 - File Deletion
T1036.006 - Space after Filename
T1204.001 - Malicious Link

MITREへのリンク →

Play

Score: 4.05

Matched TTPs:

T1070.004 - File Deletion
T1078.003 - Local Accounts

MITREへのリンク →

FIN6

Score: 3.90

Matched TTPs:

T1070.004 - File Deletion
T1566.003 - Spearphishing via Service

MITREへのリンク →

Rocke

Score: 4.67

Matched TTPs:

T1070.004 - File Deletion
T1102.001 - Dead Drop Resolver

MITREへのリンク →

Equation

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Strider

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

HAFNIUM

Score: 6.80

Matched TTPs:

T1550.001 - Application Access Token
T1078.003 - Local Accounts

MITREへのリンク →

RTM

Score: 3.29

Matched TTPs:

T1102.001 - Dead Drop Resolver

MITREへのリンク →

Velvet Ant

Score: 6.80

Matched TTPs:

T1078.003 - Local Accounts
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.77

Matched TTPs:

T1598.003 - Spearphishing Link
T1204.001 - Malicious Link
T1586.002 - Email Accounts
T1584.001 - Domains
T1078.003 - Local Accounts
T1598 - Phishing for Information
T1585.001 - Social Media Accounts
T1070.004 - File Deletion
T1566.002 - Spearphishing Link
T1566 - Phishing
T1656 - Impersonation
T1102.001 - Dead Drop Resolver
T1585.002 - Email Accounts
T1534 - Internal Spearphishing

MITREへのリンク →

Scattered Spider

Score: 0.66

Matched TTPs:

T1204 - User Execution
T1598.003 - Spearphishing Link
T1578.002 - Create Cloud Instance
T1598.004 - Spearphishing Voice
T1588.001 - Malware
T1598 - Phishing for Information
T1564.008 - Email Hiding Rules
T1656 - Impersonation
T1585.001 - Social Media Accounts

MITREへのリンク →

APT28

Score: 0.56

Matched TTPs:

T1498 - Network Denial of Service
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link
T1550.001 - Application Access Token
T1211 - Exploitation for Defense Evasion
T1586.002 - Email Accounts
T1598 - Phishing for Information
T1070.004 - File Deletion

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る