Google Warns of New Campaign Targeting BPOs to Steal Corporate Data

A financially motivated threat actor is targeting business process outsourcing (BPO) organizations to steal data pertaining to high-value companies, Google Threat Intelligence Group (GTIG) warns.

Tracked as UNC6783, the threat actor is potentially linked to a certain ‘Raccoon’ persona, used by a hacker who recently claimed the theft of various Adobe data from a third-party supplier.

UNC6783, GTIG principal threat analyst Austin Larsen says, has been engaged in social engineering and phishing campaigns targeting dozens of high-value corporate entities across multiple industries.

“The actor primarily focuses on compromising Business Process Outsourcers (BPOs) that work with these targeted companies. We have also seen them target the support and helpdesk staff of these organizations directly to gain trusted access and steal sensitive data for extortion operations,” Larsen says.

The threat actor relies on live chats to lure employees to spoofed Okta login pages and uses a phishing kit that steals clipboard contents to bypass standard multi-factor authentication (MFA) verification.

According to GTIG, UNC6783’s social engineering tactics involve fake Zendesk support pages that pose as the targeted organization’s domain.

Advertisement. Scroll to continue reading.

Using the targeted employees’ accounts, the hackers enroll their own devices to gain persistent access to the compromised environment.

“We have also observed them using fake security software updates to trick victims into downloading remote access malware. Following data exfiltration, UNC6783 has been known to use Proton Mail accounts to deliver ransom notes for data theft extortion operations,” Larsen says.

Mr. Raccoon claims Adobe data theft

GTIG’s description of UNC6783’s tactics and its mention of Raccoon suggest that the threat actor is the same Mr. Raccoon who claimed the theft of a large amount of Adobe data from a BPO firm in India.

The stolen data, the hacker said, includes the personal information of 15,000 employees, millions of support tickets, and bug bounty submissions.

The attack reportedly started with a phishing email targeting a support agent at the BPO, who was tricked into executing a RAT, thereby giving the hacker full access to their computer.

Next, the attacker performed reconnaissance and used the employee’s email address to send a second phishing email to a manager, who handed over credentials for the support platform.

Mr. Raccoon claimed to have exported the entire Adobe database from the platform with a single request.

SecurityWeek has emailed Adobe for a statement on the hacker’s claims and will update this article if the company responds.

Originally published by SecurityWeek

Full Analysis

Mr. Raccoon claims Adobe data theft