Group-IB Identifies Twilio, Cloudflare, and Over 130 Additional Victims of the 0ktapus Operation

Group-IB, one of the global leaders in cybersecurity, has discovered that the recently disclosed phishing attacks on the employees of Twilio and Cloudflare were part of the massive phishing campaign that resulted in 9,931 thousand accounts of over 130 organizations being compromised. The campaign was codenamed 0ktapus by Group-IB researchers due to the impersonation of a popular Identity and Access Management service. The vast majority of the victims are located in the United States and use Okta’s Identity and Access Management services. Group-IB Threat Intelligence team uncovered and analyzed the attackers’ phishing infrastructure, including phishing domains, the phishing kit as well as the Telegram channel controlled by the threat actors to drop compromised information. All victim organizations identified by Group-IB researchers have been notified and provided with the list of compromised accounts. The findings about the alleged identity of the threat actor have been shared with international law enforcement agencies.  

By accident or design?
On July 26, 2022, the Group-IB team received a request from its Threat Intelligence customer asking for additional information on a recent phishing attempt targeting its employees. The investigation revealed that these phishing attacks as well as the incidents at Twilio and Cloudflare were links in a chain — a simple yet very effective single phishing campaign unprecedented in scale and reach that has been active since at least March 2022. As Signal disclosures showed, once the attackers compromised an organization, they were quickly able to pivot and launch subsequent supply chain attacks.  

“While the threat actor may have been lucky in their attacks it is far more likely that they carefully planned their phishing campaign to launch sophisticated supply chain attacks,” said Roberto Martinez, Senior Threat Intelligence Analyst at Group-IB, Europe. “It is not yet clear if the attacks were planned end-to-end in advance or whether opportunistic actions were taken at each stage. Regardless, the 0ktapus campaign has been incredibly successful, and the full scale of it may not be known for some time.”

The primary goal of the threat actors was to obtain Okta identity credentials and two-factor authentication (2FA) codes from users of the targeted organizations. These users received text messages containing links to phishing sites that mimicked the Okta authentication page of their organization. 

It is still unknown how fraudsters prepared their target list and how they obtained the phone numbers. However, according to the compromised data analyzed by Group-IB, the threat actors started their attacks by targeting mobile operators and telecommunications companies and could have collected the numbers from those initial attacks.

The big score
Group-IB researchers discovered 169 unique phishing domains involved in the 0ktapus campaign. The domains used keywords like “SSO”, “VPN”, “OKTA”, “MFA”, and “HELP”. From the victim’s point of view, the phishing site looks convincing as they are very similar to the legitimate authentication page they are used to seeing. 

When analyzing the phishing sites, Group-IB specialists found they have been created using the same phishing kit that they have not seen yet in the past. Further examination of the phishing kit’s code showed the lines dedicated to the configuration of the Telegram bot and the channel used by the attackers to drop compromised data. 

Using its Threat Intelligence system, Group-IB researchers were able to analyze the compromised records obtained by the threat actors since March 2022.

The Group-IB team found that the threat actor managed to steal 9,931 user credentials, including 3,129 records with emails, and 5,441 records with MFA codes. Because two-thirds of the data didn’t contain a corporate email, but only usernames and 2FA codes, Group-IB researchers could only identify the region of residence of the victims.

Out of 136 victim organizations that Group-IB was able to identify, 114 companies are in the USA. That list also includes companies that are headquartered in other countries but have US-based employees that were targeted. Most companies on the victims’ list are providing IT, software development, and cloud services. 

Based on recent news about hijacked Signal accounts, cybercriminals may try to get access to private conversations and data. Such information can be resold to the victim’s competitors or could simply be used to ransom a victim. 

The Subject X
The Telegram features allow getting some information about the channel used by the phishing kit to collect compromised data, such as its name and the users administering it.
The Group-IB team was able to retrieve some details about the second administrator of the Telegram channel in question who goes by the nickname “X”.  

Thanks to the Group-IB Threat Intelligence system that monitors Telegram channels used by cybercriminals, the Group-IB researchers were able to identify one of the posts that “X” made in 2019 that led Group-IB to his Twitter account.
The same tool also revealed the name and last name the administrator of the channel was using, before adopting the name “X”. Looking up the Twitter handle on Google gives back a GitHub account containing the same username and profile picture. This account also suggests the location of Subject X is North Carolina, United States. 

“The methods used by this threat actor are not special, but the planning and how it pivoted from one company to another makes the campaign worth looking into,” said Rustam Mirkasymov, Head of Cyber Threat Research at Group-IB Europe. “0ktapus shows how vulnerable modern organizations are to some basic social engineering attacks and how far-reaching the effects of such incidents can be for their partners and customers. By making our findings public we hope that more companies will be able to take preventive steps to protect their digital assets.”  

Group-IB Threat Intelligence team has prepared a detailed technical blog post with a list of the indicators of compromise, more insights into the investigation, as well as some recommendations to mitigate such attacks.