Ankura CTIX FLASH Update - February 14, 2023

Malware Activity

Threat Actors Observed Using Legitimate Platform to Geo-Target Phishing Campaigns

Detailed in a new report by Avanan, threat actors were recently observed geo-targeting websites through the platform Geo Targetly. This tactic is used to improve their phishing campaigns by sending customized, geo-specific content (typically by language and region) to different users in one phishing email. Geo Targetly is a legitimate platform that allows "advertisers to redirect users to pages and ads in their local markets" by determining the users' geolocation. These threat actors are utilizing a variant of the "spray-and-pray" technique, which is when an actor sends out a large volume of phishing emails and few are successful. The unique aspect in this campaign is that the content is always relevant and localized across the large volume of targeted users, which is being referred to as "spraying without the praying." The customization increases the likelihood of