PhishingPublished 19 Dec 2023Updated 15 Jul 2024

tlp clear · Phishing targeting Luxembourg services (hosted and served on/from AWS)

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

A phishing campaign is actively targeting services associated with Luxembourg, leveraging fake websites hosted and served from AWS infrastructure. This threat uses highly convincing psychological techniques to deceive users into divulging sensitive information. Although no specific vulnerable software versions are identified and no patches are available, the attack exploits social engineering rather than technical vulnerabilities. The campaign is categorized under MITRE ATT&CK pattern T1566 and is ongoing with no known exploits in the wild beyond phishing attempts. European organizations, especially those with ties to Luxembourg or using AWS-hosted services, face risks of credential theft and potential subsequent compromise. Mitigation requires targeted user awareness, email filtering, and monitoring of AWS-hosted domains mimicking legitimate Luxembourg services. Luxembourg is the primary affected country, but neighboring countries with close economic or governmental ties may also be at risk. Given the ease of exploitation and potential impact on confidentiality, the threat severity is assessed as medium. Defenders should prioritize detection and user education to reduce the success of these phishing attempts.

Impact

For European organizations, particularly those operating in or with Luxembourg, this phishing campaign poses a tangible risk of credential compromise and unauthorized access. Successful phishing can lead to data breaches, financial fraud, and erosion of trust in digital services. Organizations relying on AWS-hosted services for Luxembourg-related operations may see increased targeting, potentially affecting business continuity and regulatory compliance, especially under GDPR. The psychological sophistication of the phishing attempts increases the likelihood of user deception, which can cascade into broader network compromises if attackers use stolen credentials to move laterally. Public sector entities, financial institutions, and critical infrastructure providers in Luxembourg are especially vulnerable due to the strategic importance of their services. Neighboring countries with close economic or governmental ties to Luxembourg may also experience spillover effects, including phishing attempts mimicking Luxembourg services to target cross-border operations. The lack of technical vulnerabilities means traditional patching is ineffective, placing greater emphasis on user vigilance and detection capabilities. Overall, the campaign threatens confidentiality and integrity, with potential downstream impacts on availability if attackers leverage access for ransomware or disruptive activities.

Defensive guidance

To mitigate this phishing threat, European organizations should implement multi-layered defenses focused on detection, prevention, and user education. Deploy advanced email filtering solutions capable of identifying and quarantining phishing emails, including those with links to AWS-hosted fake websites. Utilize domain monitoring services to detect and take down fraudulent domains impersonating Luxembourg services, collaborating with AWS abuse teams for rapid response. Conduct targeted phishing awareness training emphasizing recognition of sophisticated social engineering tactics and the risks of interacting with unsolicited links or requests for credentials. Enforce multi-factor authentication (MFA) across all critical systems to reduce the impact of credential compromise. Implement robust incident response procedures to quickly isolate and remediate accounts suspected of being phished. Leverage threat intelligence feeds, such as CIRCL OSINT, to stay informed about emerging phishing campaigns and indicators. Regularly review and update security policies to address cloud-hosted phishing infrastructure challenges. For organizations with Luxembourg operations, consider additional verification steps for sensitive transactions or access requests. Finally, encourage reporting of suspected phishing attempts to improve organizational and community-wide defenses.

Summary

This threat involves a phishing campaign specifically targeting services related to Luxembourg, with the phishing infrastructure hosted on Amazon Web Services (AWS). The attackers create fake websites that impersonate legitimate Luxembourg services, aiming to trick users into submitting sensitive credentials or other confidential information. The campaign is identified through CIRCL OSINT feeds and is linked to the MITRE ATT&CK technique T1566, which covers phishing attacks. The psychological acceptability of the phishing lure is high, indicating that the fake websites and messages are crafted to appear very convincing and trustworthy to the target audience. No specific software vulnerabilities or affected product versions are noted, as the attack vector relies on social engineering rather than exploiting technical flaws. There are no known exploits in the wild beyond the phishing attempts themselves, and no patches or technical mitigations are available. The hosting on AWS suggests attackers leverage cloud infrastructure to rapidly deploy and rotate phishing sites, complicating takedown efforts. The campaign is ongoing and perpetual, indicating persistent targeting of Luxembourg-related services. Indicators of compromise are not provided, which may hinder automated detection. The threat primarily risks confidentiality breaches through credential theft, which could lead to further network intrusion or fraud if attackers leverage stolen credentials. The medium severity rating reflects the significant impact possible if users are deceived, balanced against the non-technical nature of the attack and the need for user interaction.

Indicators of compromise

Domains 47

ccss-public.com
cns-lu.com
luxtrust.support
luxtrust.help
www-cns-lu.com
www-cns.com
luxtrust-cancel.com
luxtrust-unlock.com
ccss-sante-lu.com
ccss.support

URLs 23

https://public-ccss.com/index.php
https://sante-lu.com/index.php
https://sante-lu.com/
https://public-ccss.com/index.php
https://help-luxtrust.lu/index.php?success=validatedok
https://carte-sante-lu.com/index.php?success=validatedok
https://cns-order.com/
https://infoluxtrust.com/steps/luxtrust/
https://luxtrust.help/
https://ccss.digital/

IP addresses 22

18.117.184.102
54.93.211.218
35.177.103.239
3.71.1.255
51.20.69.186
3.71.1.255
3.71.1.255
54.170.251.238
3.79.236.229
52.59.212.17

Counter 48

Text 226

https://www.circl.lu/pdns/
A
18.117.184.102
luxtrust.help
https://www.circl.lu/pdns/
A
18.117.184.102
luxtrust.support
https://www.circl.lu/pdns/
NS

Datetime 96

2023-12-07T13:42:52+00:00
2023-12-07T13:42:52+00:00
2023-12-15T14:56:56+00:00
2023-12-19T07:22:05+00:00
2023-12-19T07:22:05+00:00
2023-12-19T07:22:05+00:00
2023-12-19T07:22:05+00:00
2023-12-19T07:22:05+00:00
2023-12-19T07:22:05+00:00
2023-12-19T07:22:05+00:00

tlp clear · Phishing targeting Luxembourg services (hosted and served on/from AWS)

Description

Impact

Defensive guidance

Summary

Indicators of compromise

Domains 47

URLs 23

IP addresses 22

Counter 48

Text 226

Datetime 96

Port 9

As 1

Community reviews

Description

AI analysisMachine-generated, updated 24 Dec 2025, 06:13 UTC

Indicators of compromise

Domains 47

URLs 23

IP addresses 22

Counter 48

Text 226

Datetime 96

Port 9

As 1

Community reviews

Related threats