Ankura CTIX FLASH Update - September 16, 2022

Ransomware/Malware Activity

New Phishing Campaign Capitalizing on the Death of Queen Elizabeth II

Threat actors have begun taking advantage of the recent death of Queen Elizabeth II in a phishing campaign discovered by Proofpoint Threat Insight researchers. The campaign's goal is to exfiltrate the victims' multi-factor authentication (MFA) codes and compromise their Microsoft account credentials. On September 14, 2022, researchers posted on Twitter that the phishing campaign is impersonating "the Microsoft team" and attempting to lure victims to a fraudulent online memory board that includes "millions of memorable words and thousands of letters and photos." The email's subject contains "Join our AI space in memory of Queen Elizabeth II" and the email body includes links to a URL redirecting credential harvesting page. The researchers also noted that this campaign appears to be using the EvilProxy reverse-proxy Phishing-as-a-Service (PaaS) kit, which was reported