How phishing-as-a-service operations pose a threat to organizations

Just as many legitimate businesses outsource operations and services, so do cybercriminals. Cybercrime as a service has expanded to malware, ransomware and even phishing campaigns. A Microsoft blog post published on Tuesday looks at one specific phishing-as-a-service operation and the danger it poses to organizations.

SEE: Social engineering: A cheat sheet for business professionals (free PDF) (TechRepublic)  

Named BulletProofLink, this criminal enterprise sells phishing kits, email templates, hosting facilities and automated services at a relatively low cost, according to Microsoft.

Also known as BulletProftLink and Anthrax, this large-scale operation is the culprit behind many of today’s phishing campaigns with more than 100 templates that impersonate known brands and services. Different cybercriminals use BulletProofLink to conduct monthly subscription-based attacks, resulting in an ongoing source of revenue for the operator.

With this type of phishing-as-a-service (PhaaS) business, attackers pay an operator to develop and deploy either parts of a campaign or the entire campaign. Included in the package are such items as phony sign-in pages, website hosting and credential parsing and redistribution. The PhaaS business model contrasts with criminals who simply sell phishing kits with email and website templates for a one-time fee.

Active since 2018, BulletProofLink promotes its services at its About Us page, touting unique scam pages, monthly subscriptions and a trusted brand. Using the names BulletProftLink, BulletProofLink and Anthrax interchangeably, the operation also hosts pages on YouTube and Vimeo with instructional advertisements. An online store lets customers register, sign in and promote their hosted service. The subscription service can cost attackers as much as $800, while a one-time hosting link runs around $50.

The PhaaS model as used by BulletProofLink employs a type of double-extortion strategy. The phishing kits include a second location where stolen credentials are sent. As long as the attacker doesn’t change the code, this means that BulletProofLink also receives every set of credentials, allowing them to maintain ultimate control.

“Email phishing and related cyber crime is far more complex than many people give it credit for, as is made obvious by this look into the seedy world of ‘as-a-service’ offerings, such as PhaaS (Phishing-as-a-Service) and RaaS (Ransomware-as-a-Service),” said KnowBe4 Security Awareness Advocate Erich Kron. “These services are generally low cost and often employ profit-sharing schemes that allow bad actors to get into the cybercrime game at little or no upfront cost. These vendors often provide tools and information, even training, to help their affiliates improve their success rates and to boost their own profits.”

SEE: Security Awareness and Training policy (TechRepublic)  

How can organizations combat these types of phishing attacks?

Set up anti-phishing policies with mailbox intelligence settings and configure impersonation protection settings for specific messages and sender domains, advises Microsoft. Further, enable SafeLinks to scan for malicious links at time of delivery and at time of click.

Organizations also need to take email phishing seriously to protect themselves against cybercrime gangs, suggested Kron. This means training employees to spot and report phishing emails and require unique, complex passwords across the board.

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.
Delivered Tuesdays and Thursdays

Sign up today

Also see