#coordinated disruption

Large scale disruptions are rather few and far between. In the six months I’ve been writing these reports, only one or two come to mind compared to near constant campaigns and incursions. Part of this is because disruptions at scale take time and effort to coordinate on a ‘battlefield’ that’s always changing. But today I get to add another to their number. Europol, in conjunction with Microsoft, TrendAI™, CloudFlare, Coinbase, Crowell, eSentire, Health-ISAC, Intel471, Proofpoint, Resecurity, The Shadowserver Foundation, SpyCloud, and other law enforcement agencies have successfully seized over 300 domains associated with the phishing-as-a-service known as Tycoon2FA.

Threat actors such as Tycoon2FA are not attackers in their own right. Instead they provide man-in-the-middle type services, linking lesser skilled operators with effective toolkits that they don’t necessarily need to understand, since the service does all the work. In this case, that service is as a proxy in between attackers, their victims, and legitimate login pages. Once infiltration is successful, they harvest credentials, MFA codes, and session cookies in real time. That data is then sent back to the ‘client’ to replay when MFA is enabled to take over accounts. This can create a cascading effect beyond the original point of compromise, as stolen sessions and accounts can be reused, resold, and repurposed across multiple operations.

Trend Micro states that, at the time of yesterday’s report, Tycoon2FA had some two thousand users, with over 24,000 domains since its arrival on the scene in 2023. The platform operates at a large scale, providing a ready to use toolkit that requires little setup by those using it. Some versions include evasion features to make detection more difficult, like anti-bot screening, browser fingerprinting, heavy code obfuscation, self-hosted CAPTCHAs, custom JavaScript, and dynamic decoy pages.

In terms of financial damage, phishing does not compare to something like ransomware, but Trend Micro warns that it shouldn’t underestimated, since the tactic is widespread and often easily missed, since it requires the victim to take the bait to be initialized. They go on to say that operations like these are hard to track due to the very nature of phishing. The infrastructure, hosting, and victims involved are spread across many countries and networks, and need the cooperation of many levels of detection, analysis and legal authority to disrupt. Microsoft Threat Intelligence, who also published a report on this disruption, states that campaigns using Tycoon2FA have appeared across nearly all sectors including education, healthcare, finance, non-profit, and government. The platform enabled threat actors to impersonate trusted brands by mimicking sign-in pages for services like Microsoft 365, OneDrive, Outlook, SharePoint, and Gmail. By stealing session cookies and MFA codes, persistence can be enacted even after passwords are reset unless explicitly revoked (when one clears their browser of all history and cookies, which is a good preventative measure to begin with).

While this disruption does not mitigate the damage done to already compromised victims, it does hinder subsequent attack campaigns. A coordinated effort involving tracking, analysis, and disruption efforts makes it harder for operations to rebuild and reuse tools, or move to a new platform without being noticed at least in the short to medium term by someone. Trend Micro, for instance, states that it will continue to monitor any activity that might resemble Tycoon2FA, while MTI offers a variety of tips for users to protect themselves now and in the future. Congrats to all those involved in this disruption, it was a lot of hard work and cooperation. I tip my hat to you all.