0ktapus campaign: Twilio, Cloudflare, and over 130 more victims discovered by Group-IB

Group-IB, one of the global leaders in cybersecurity, has discovered that the recently disclosed phishing attacks on the employees of Twilio and Cloudflare were part of the massive phishing campaign that resulted in 9,931 thousand accounts of over 130 organizations being compromised. The campaign was codenamed 0ktapus by Group-IB researchers due to the impersonation of a popular Identity and Access Management service. The vast majority of the victims are located in the United States and many of them use Okta’s Identity and Access Management services. Group-IB Threat Intelligence team uncovered and analyzed the attackers’ phishing infrastructure, including phishing domains, the phishing kit as well as the Telegram channel controlled by the threat actors to drop compromised information. All victim organizations identified by Group-IB researchers have been notified and provided with the list of compromised accounts. The findings about the alleged identity of the threat actor have been shared with international law enforcement agencies.

By accident or design?

On July 26, 2022, the Group-IB team received a request from its Threat Intelligence customer asking for additional information on a recent phishing attempt targeting its employees. The investigation revealed that these phishing attacks as well as the incidents at Twilio and Cloudflare were links in a chain a simple yet very effective single phishing campaign unprecedented in scale and reach that has been active since at least March 2022. As Signal disclosures showed, once the attackers compromised an organization, they were quickly able to pivot and launch subsequent supply chain attacks.

While the threat actor may have been lucky in their attacks it is far more likely that they carefully planned their phishing campaign to launch sophisticated supply chain attacks. It is not yet clear if the attacks were planned end-to-end in advance or whether opportunistic actions were taken at each stage. Regardless, the 0ktapus campaign has been incredibly successful, and the full scale of it may not be known for some time.

Roberto Martinez
Roberto Martinez

Senior Threat Intelligence analyst at Group-IB, Europe.

The primary goal of the threat actors was to obtain Okta identity credentials and two-factor authentication (2FA) codes from users of the targeted organizations. These users received text messages containing links to phishing sites that mimicked the Okta authentication page of their organization.

It is still unknown how fraudsters prepared their target list and how they obtained the phone numbers. However, according to the compromised data analyzed by Group-IB, the threat actors started their attacks by targeting mobile operators and telecommunications companies and could have collected the numbers from those initial attacks.

The big score

Group-IB researchers discovered 169 unique phishing domains involved in the 0ktapus campaign. The domains used keywords like “SSO“, ”VPN“, “OKTA”, ”MFA“, and ”HELP”. From the victim’s point of view, the phishing site looks convincing as they are very similar to the legitimate authentication page they are used to seeing.

When analyzing the phishing sites, Group-IB specialists found they have been created using the same phishing kit that they have not seen yet in the past. Further examination of the phishing kit’s code showed the lines dedicated to the configuration of the Telegram bot and the channel used by the attackers to drop compromised data.

Using its Threat Intelligence system, Group-IB researchers were able to analyze the compromised records obtained by the threat actors since March 2022.

The Group-IB team found that the threat actor managed to steal 9,931 user credentials, including 3,129 records with emails, and 5,441 records with MFA codes. Because two-thirds of the data didn’t contain a corporate email, but only usernames and 2FA codes, Group-IB researchers could only identify the region of residence of the victims.

Out of 136 victim organizations that Group-IB was able to identify, 114 companies are in the USA. That list also includes companies that are headquartered in other countries but have US-based employees that were targeted. Most companies on the victims’ list are providing IT, software development, and cloud services.

Based on recent news about hijacked Signal accounts, cybercriminals may try to get access to private conversations and data. Such information can be resold to the victim’s competitors or could simply be used to ransom a victim.

The Subject X

The Telegram features allow getting some information about the channel used by the phishing kit to collect compromised data, such as its name and the users administering it.

The Group-IB team was able to retrieve some details about the second administrator of the Telegram channel in question who goes by the nickname “X”.

Thanks to the Group-IB Threat Intelligence system that monitors Telegram channels used by cybercriminals, the Group-IB researchers were able to identify one of the posts that “X” made in 2019 that led Group-IB to his Twitter account. The same tool also revealed the name and last name the administrator of the channel was using, before adopting the name “X“. Looking up the Twitter handle on Google gives back a GitHub account containing the same username and profile picture. This account also suggests the location of Subject X is North Carolina, United States.

The methods used by this threat actor are not special, but the planning and how it pivoted from one company to another makes the campaign worth looking into. 0ktapus shows how vulnerable modern organizations are to some basic social engineering attacks and how far-reaching the effects of such incidents can be for their partners and customers. By making our findings public we hope that more companies will be able to take preventive steps to protect their digital assets.

Rustam Mirkasymov
Rustam Mirkasymov

Head of Cyber Threat Research at Group-IB Europe

Group-IB Threat Intelligence team has prepared a detailed technical blog post with a list of the indicators of compromise, more insights into the investigation, as well as some recommendations to mitigate such attacks.

About Group-IB

Group-IB, with its headquarters in Singapore, is one of the leading providers of solutions dedicated to detecting and preventing cyberattacks, identifying online fraud, investigating high-tech crimes, and protecting intellectual property. The company’s Threat Intelligence and Research Centers are located in the Middle East (Dubai), the Asia-Pacific (Singapore), and Europe (Amsterdam).

Group-IB’s Unified Risk Platform is an ecosystem of solutions that understands each organization’s threat profile and tailors defenses against them in real-time from a single interface. The Unified Risk Platform provides complete coverage of the cyber response chain. Group-IB’s products and services consolidated in Group-IB’s Unified Risk Platform include Group-IB’s Threat IntelligenceManaged XDRDigital Risk ProtectionFraud ProtectionAttack Surface ManagementBusiness Email ProtectionAudit & ConsultingEducation & TrainingDigital Forensics & Incident ResponseManaged Detection & Response, and Cyber Investigations.

Group-IB’s technological leadership and R&D capabilities are built on the company’s 19 years of hands-on experience in cybercrime investigations worldwide and more than 70,000 hours of cybersecurity incident response accumulated in our leading DFIR Laboratory, High-Tech Crime Investigations Department, and round-the-clock CERT-GIB.

Group-IB is an active partner in global investigations led by international law enforcement organizations such as Europol and INTERPOL. Group-IB is also a member of the Europol European Cybercrime Centre’s (EC3) Advisory Group on Internet Security, which was created to foster closer cooperation between Europol and its leading non-law enforcement partners.

Group-IB’s experience in threat hunting and cyber intelligence has been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyberattacks. Group-IB’s mission is to protect its clients in cyberspace every day by creating and leveraging innovative solutions and services.

Group-IB’s experience in threat hunting and cyber intelligence has been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyberattacks. Group-IB’s mission is to fight high-tech crime while protecting our clients in cyberspace and helping them achieve their goals. To do so, we analyze cyber threats, develop our infrastructure to monitor them, respond to incidents, investigate complex high-tech crimes, and design unique technologies, solutions, and services to counteract adversaries.