PhishingPublished 13 Jan 2025

type osint · "Packets everywhere!" report about delivery abuse system and phishing

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

"Packets everywhere!" report about delivery abuse system and phishing

Impact

For European organizations, especially those operating in or with France, this phishing threat poses risks primarily to employees and customers who receive delivery notifications. Successful phishing can lead to credential compromise, unauthorized access to corporate or personal accounts, and financial losses through fraud. Organizations in logistics, e-commerce, and financial sectors are particularly vulnerable due to their reliance on delivery services and frequent customer interactions involving shipments. The impact extends beyond direct financial loss to potential reputational damage if customers are defrauded using the organization's brand or services. Additionally, compromised credentials could facilitate further attacks such as business email compromise or lateral movement within corporate networks. The low severity rating suggests limited immediate disruption, but the persistent and evolving nature of smishing campaigns means that without adequate defenses, the threat could escalate. European organizations must consider the cross-border nature of such phishing campaigns, as attackers may leverage regional delivery brands and languages to increase effectiveness.

Defensive guidance

To mitigate this threat, European organizations should implement targeted anti-phishing training that includes awareness of delivery-related scams and smishing tactics. Employees and customers should be educated to verify delivery notifications through official channels rather than clicking on links in unsolicited messages. Technical controls such as SMS filtering solutions, email security gateways with phishing detection, and URL reputation services can help block malicious messages. Organizations should also enforce multi-factor authentication (MFA) to reduce the risk of compromised credentials leading to account takeover. Monitoring for unusual login activity and implementing anomaly detection can help identify potential breaches early. Collaboration with delivery service providers to authenticate legitimate communications using mechanisms like DMARC, DKIM, and SPF for email, and verified sender IDs for SMS, can reduce spoofing risks. Incident response plans should include procedures for handling phishing incidents and customer notifications to minimize damage. Finally, organizations should monitor OSINT feeds and threat intelligence sources for updates on evolving phishing campaigns targeting their sectors or regions.

Indicators of compromise

Domains 911

472.correos-co.infoPhishing domains
472paquete.comPhishing domains
712pm.comPhishing domains
abo-netlfix.comPhishing domains
abonnement-erneuerung.comPhishing domains
abtblanck.comPhishing domains
acces-a-mon-compte.comPhishing domains
acces-espace-sante.infoPhishing domains
accesosuscrinjx.infoPhishing domains
access-ups.infoPhishing domains

IP addresses 3

142.93.43.165
45.202.35.53
62.60.226.12

Link 1

https://cedricpernet.net/PacketsEverywhere.pdf

Text 3

Packets everywhere! Written by Cedric Pernet / Senior Threat Researcher. Contrary to what this -tle may suggest, this quick post will not be about network packets, so tcpdump or Wireshark freaks will probably not be so interested ;-) Instead, it will be about phishing impersonating a packet delivery company. I had a bit of free time this weekend and thought I would use it to share some quick threat hunting on a particular phishing case. This publication also provides a few ways to actively monitor this threat and discover new fraudulent activity.
Packets everywhere!
Report

File 1

PacketsEverywhere.pdf

Community reviews

Loading reviews…