An active voice phishing (vishing) campaign is being used to attacked those workers, form many different industries, who are currently working remotely.

The campaign sees threat actors pretending to be a trusted entity and try to leverage social engineering tactics to persuade victims to share access to their corporate Virtual Private Network (VPN).

A joint advisory about the attacks has been released by the Federal Bureau of Investigation (FBI) and the DHS Cybersecurity and infrastructure Security Agency (CISA). This type of attack has grown in popularity in recent times to the the huge increase in remote working during the COVID-19 pandemic.

The attack begins with the hacking group buying and registering domains that are used to host phishing pages that pretend to be the targeted company’s internal VPN login page and SSL certificates are obtained for the domains to make them appear real. Many naming schemes are used for the domains to make them appear real, such as [company]-support, support-[company], and employee-[company]. The cybercriminals then harvest data about company employees.

The range of information collected includes names, addresses, personal phone numbers, job titles, and length of time at the company. That information is then used to gain the trust of the targeted staff member.

Employees are then contacted from a voice-over-IP (VOIP) number. Initially the VOIP number was not revealed, but later in the campaign the hackers began spoofing the number to make it appear that the call was coming from a company office or another staff member in the firm. Employees are then told they will be sent a link that they need to click to login to a new VPN system. They are also told that they will need to answer any 2-factor authentication and one-time password communications shared to their phone.

The attackers capture the login information as it is entered into their fake website and use it to login to the proper VPN page of the company. They then capture and use the 2FA code or one-time password when the employee responds to the SMS message.

The hackers have also used SIM-swap to bypass the 2FA/OTP step, using information gathered about the employee to persuade their mobile telephone provider to port their phone number to the attacker’s SIM. This ensures any 2FA code is sent directly to the hacker. The threat actors use the details to access the company network to steal sensitive data to use in other attacks. The FBI/CISA say the end goal is to make profit from the VPN access.

The FBI/CISA recommend groups limit VPN connections to managed devices using mechanisms such as hardware checks or downloaded certificates, to restrict the hours that VPNs can be used to access the corporate network, to use domain monitoring tools to manage web applications for unauthorized access and anomalous activities.

A formal authentication procedure should also be created for employee-to-employee communications over the public telephone network where a second factor is required to authenticate the phone call before the disclosure of any sensitive data

Data should also monitor authorized user access and usage to spot anomalous activities and employees should be notified about the scam and instructed to report any suspicious calls to their security department.