Ankura CTIX FLASH Update - November 15, 2022

Ransomware/Malware Activity

Fanxiao Domain Spoofing Campaign Accrues Network of Over 42,000 Malicious and Redirect Websites

Researchers from Cyjax have published a report on how a financially motivated threat group known as "Fangxiao" is conducting a massive website spoofing campaign, having built a network of approximately 42,000 domains. The domains mimic very popular brands like Coca Cola, Emirates, McDonalds, and many more as the campaign spoofs entities in the retail, banking, travel, pharmaceuticals, transport, financial, and energy sectors. This campaign appears to function as a traffic generation scam to earn ad revenue for the threat group's own sites, as well monetizing the user data of victims unlucky enough to arrive at one of their honeypot domains. According to the researchers monitoring Fangxiao's activity, the threat group is registering approximately 300 new spoofed domains per day. To add insult to injury, some of the sites contain redirect