Report DIVD-2020-00013 - Leaked Phishing Credentials
Written on 01 Jul 2021 by Joris van de Vis
Case lead:
Frank Breedijk
Researchers:
Bauke Gehem (external)
Case file: DIVD-2020-00013
At the end of November 2020, criminals engaged in a phishing campaign mimicking Zoom message invites and a message on mail quarantine. This campaign was reported on Twitter by TheAnalyst.
While researching this phishing campaign, Bauke Gehem of Summa College, discovered that the phishing infrastructure used by the criminals was not properly secured and leaked the captured usernames and passwords because of unsecured directories. From a partner CERT, DIVD CSIRT has been given the Dutch part of the harvested credentials to inform potential victims.
After an internal discussion we came to the conclusion that victims of the attack should be informed. We started processing the data internally to prepare for informing the victims and to give them some additional advice on how to proceed. Since we received the Dutch part of the data it was decided to write the emails in Dutch and English.
On 1-1-2021 email notifications were sent to the victims of the phishing campaign. A total of 370 emails were sent.
As there was no new information and the victims were informed, the case was closed after the emails were sent. Involved researchers deleted their local data, with only report writing waiting to be done. This was done in June 2021.
Timeline
| Date | Description |
|---|---|
| 29-11-2020 | Phishing campaign reported on Twitter |
| 08-12-2020 | Dutch list received by DIVD CSIRT |
| 08-12-2020 - 20-12-2020 | Internal discussion about how to best handle cases like this |
| 1-1-2021 | Emails sent |
| 22-06-2021 | This report was written |