EvilProxy AiTM Campaign: Procurement Lures & Credential Theft — OTX Pulse Analysis

Threat Summary

Analysis of the recent OTX pulse reveals a sophisticated Adversary-in-the-Middle (AiTM) phishing campaign, tracked under the tags "FlowerStorm" and "Kali365," actively targeting Education, Government, and Finance sectors. Since May 2026, this campaign has leveraged compromised organizational email accounts to distribute procurement-themed lures. These lures—mimicking requests for information (RFI), bid invitations, and project documentation—are highly effective against multinational institutions, including EU and UN agencies.

The attack chain relies on redirecting victims through a reverse proxy infrastructure (identified as EvilProxy in references). This allows the threat actor to intercept authentication sessions, bypassing Multi-Factor Authentication (MFA) through real-time credential relay and session cookie theft. The ultimate objective is to gain unauthorized access to corporate email and cloud environments to facilitate further fraud, data exfiltration, or lateral movement.

Threat Actor / Malware Profile

• Actor Designation: Unknown (associated with tags: FlowerStorm, Kali365).
• Attack Vector: Highly Targeted Phishing (Business Email Compromise derived).
• Tooling: EvilProxy (Phishing-as-a-Service).

Operational Profile

• Distribution Method: The campaign utilizes compromised internal email accounts to send "procurement" themed documents. This social engineering tactic establishes immediate trust, as the email appears to come from a known colleague or partner.
• Payload Behavior: Unlike traditional malware, this campaign does not rely on executable payloads. Instead, it uses a reverse proxy site hosted on the infrastructure listed in the IOCs. When victims attempt to log in, the proxy sits between the user and the legitimate service (e.g., O365, Entra ID).
• C2 & Communication: Communication is handled via the proxy domains (e.g., sohantraders.com, corporatetermscompliance.com). The adversary uses these domains to relay authentication requests (including MFA codes) to the legitimate service and return the session cookies to the actor.
• Persistence & Access: Persistence is achieved via session hijacking (Pass-the-Cookie). By stealing the session token issued post-MFA, the actor maintains access to the victim's account without needing the password or a second MFA factor until the session expires.

IOC Analysis

The provided indicators of compromise (IOCs) consist entirely of domain names. These domains act as the landing pages for the AiTM attacks and the nodes for the EvilProxy infrastructure.

• Indicator Types: Domains.
• Operational Guidance: SOC teams should immediately block these domains at the DNS layer (Firewall/DNS forwarder) and upload them to security gateways (SWG/Email Secure Gateway) for URL filtering.
• Decoding & Analysis: These domains are often recently registered or "doppelganger" domains designed to look like legitimate corporate entities (e.g., corporatetermscompliance.com). Analysts should perform passive DNS (pDNS) lookups to identify additional resolving IPs or subdomains used by the actor to bypass simple domain blocks.

Detection Engineering

Sigma Rules

title: DNS Query to AiTM Phishing Infrastructure - Procurement Campaign
id: 7c2e1a9b-4d8f-3a6e-1c2b-5e4f6a7b8c9d
status: stable
description: Detects DNS queries to domains associated with the active procurement-themed AiTM phishing campaign leveraging EvilProxy.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/08/03
tags:
    - attack.credential_access
    - attack.t1566.002
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'sohantraders.com'
            - 'satoriestate.com'
            - 'duemineral.uk'
            - 'assessmentevaluationreport.com'
            - 'barifurniture.net'
            - 'consistenthostinghub.de'
            - 'corporatetermscompliance.com'
            - 'designenhancessatisfaction.de'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: Suspicious Browser Process Access - Potential Session Hijack
id: 9d3f2b1c-5e9g-4b7f-2d3c-6f5g7a8b9c0d
status: stable
description: Detects local processes accessing browser memory or handles, often indicative of cookie theft or session hijacking following a successful AiTM login.
author: Security Arsenal
date: 2026/08/03
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        SourceImage|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x1410'
            - '0x143a'
    condition: selection
falsepositives:
    - Legitimate password managers or browser extensions
level: medium

KQL (Microsoft Sentinel)

// Hunt for network connections to known AiTM infrastructure domains
DeviceNetworkEvents
| where RemoteUrl in~ ("sohantraders.com", "satoriestate.com", "dueminital.uk", "assessmentevaluationreport.com", "barifurniture.net", "consistenthostinghub.de", "corporatetermscompliance.com", "designenhancessatisfaction.de")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, ActionType, RemotePort
| extend FullUrl = strcat("https://", RemoteUrl)
| order by Timestamp desc

PowerShell Hunt Script

# IOC Hunt: Check DNS Client Cache for AiTM Domains
$TargetDomains = @( 
    "sohantraders.com", 
    "satoriestate.com", 
    "duemineral.uk", 
    "assessmentevaluationreport.com", 
    "barifurniture.net", 
    "consistenthostinghub.de", 
    "corporatetermscompliance.com", 
    "designenhancessatisfaction.de" 
)

Write-Host "[INFO] Hunting for AiTM Phishing Domains in DNS Cache..." -ForegroundColor Cyan

$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue

if ($null -eq $DnsCache) {
    Write-Host "[WARN] Unable to read DNS Cache. Run as Administrator." -ForegroundColor Yellow
    exit
}

$ThreatFound = $false

foreach ($Domain in $TargetDomains) {
    $Match = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
    
    if ($Match) {
        $ThreatFound = $true
        Write-Host "[THREAT] IOC Detected in DNS Cache: $Domain" -ForegroundColor Red
        Write-Host "Details - Entry: $($Match.Entry), Data: $($Match.Data), Type: $($Match.Type)"
    }
}

if (-not $ThreatFound) {
    Write-Host "[CLEAN] No current DNS cache entries found for IOCs." -ForegroundColor Green
}

Response Priorities

• Immediate: Block all listed IOC domains at the DNS perimeter and web proxy. Isolate any endpoints showing confirmed DNS hits to these domains.
• 24h: Conduct identity verification for users in the targeted sectors (Education/Gov) who may have interacted with procurement emails. Revoke active session tokens for potentially compromised accounts.
• 1 Week: Update email security gateways to flag procurement-themed language from external senders. Deploy Conditional Access Policies requiring device compliance or specific locations for highly sensitive administrative roles to mitigate AiTM success.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub