Procurement-Themed AiTM Phishing: FlowerStorm & EvilProxy Campaign — OTX Pulse Analysis

Threat Summary

A sophisticated Adversary-in-the-Middle (AiTM) phishing campaign has been active since May 2026, specifically targeting global institutions including universities, government bodies, and multinational organizations (notably EU and UN agencies). Based on OTX pulse data, this campaign leverages compromised organizational email accounts to distribute highly convincing procurement-themed lures. These lures mimic requests for information (RFIs), bid invitations, and project documentation.

The adversary utilizes infrastructure associated with EvilProxy, a Phishing-as-a-Service (PaaS) platform, to facilitate Adversary-in-the-Middle attacks. This allows the threat actor to bypass Multi-Factor Authentication (MFA) by intercepting authentication sessions and stealing session cookies. The ultimate objectives are credential theft, session hijacking, and gaining unauthorized access to sensitive enterprise email and document repositories.

Tags associated with this activity suggest potential ties to or tactics overlap with the FlowerStorm (aka TA456) threat actor group, known for prolonged social engineering campaigns.

Threat Actor / Malware Profile

Adversary: Likely FlowerStorm / TA456 (Associated Tactics)

Infrastructure: EvilProxy (Reverse Proxy)

• Distribution Method: Spear-phishing originating from previously compromised internal email accounts (account takeover). Emails contain legitimate-looking attachments or links leading to phishing portals.
• Attack Technique (AiTM): The phishing sites act as a reverse proxy between the victim and the legitimate service provider (e.g., Microsoft 365, Outlook Web Access).
• Payload Behavior: No traditional "malware" executable is required for the initial compromise. The "payload" is the interception of the authentication flow (POST requests) containing credentials and MFA codes/tokens.
• C2 Communication: Communications are routed through the advertised phishing infrastructure (e.g., sohantraders.com, corporatetermscompliance.com), which then forwards traffic to the legitimate destination, keeping the session alive.
• Persistence Mechanism: Once session cookies are stolen, adversaries use them to maintain access via "Pass-the-Cookie" attacks, bypassing standard auth checks without triggering MFA prompts again until the session expires.
• Anti-Analysis: Use of registered domains that often mimic legitimate corporate terminology or generic business services to blend in with traffic.

IOC Analysis

The provided IOCs consist primarily of domains serving as the AiTM proxy landing pages.

• Indicator Types: Domains (specifically sohantraders.com, satoriestate.com, duemineral.uk, etc.).
• Operationalization: SOC teams should immediately block these domains at the DNS layer (DNS sinkholing) and the Web Proxy layer.
• Decoding/Tooling: These domains resolve to the phishing infrastructure. Security teams should use SIEM solutions (e.g., Splunk, Microsoft Sentinel) to query DeviceNetworkEvents or proxy logs for any historical connections to these domains to identify potentially compromised users.

Detection Engineering

title: Suspicious DNS Query to AiTM Phishing Infrastructure
id: aitm-phishing-dns-detection
description: Detects DNS queries to domains associated with the procurement-themed AiTM phishing campaign leveraging EvilProxy.
status: experimental
date: 2026/08/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6228302583f4588e4d5c0e50/
tags:
    - attack.credential_access
    - attack.t1557.001
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'sohantraders.com'
            - 'satoriestate.com'
            - 'duemineral.uk'
            - 'assessmentevaluationreport.com'
            - 'barifurniture.net'
            - 'consistenthostinghub.de'
            - 'corporatetermscompliance.com'
            - 'designenhancessatisfaction.de'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Network Connection to Procurement Phishing Domains
id: aitm-phishing-network-connection
description: Identifies outbound network connections to known AiTM proxy domains used in procurement-themed campaigns.
status: experimental
date: 2026/08/03
author: Security Arsenal
tags:
    - attack.credential_access
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection:
        destination_domain|contains:
            - 'sohantraders.com'
            - 'satoriestate.com'
            - 'duemineral.uk'
            - 'assessmentevaluationreport.com'
            - 'barifurniture.net'
            - 'consistenthostinghub.de'
            - 'corporatetermscompliance.com'
            - 'designenhancessatisfaction.de'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: Potential Procurement Phishing Email Keywords
id: aitm-phishing-email-lures
description: Hunting rule for emails containing procurement-themed lures indicative of the FlowerStorm campaign.
status: experimental
date: 2026/08/03
author: Security Arsenal
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    product: email
detection:
    keywords_subject:
        Subject|contains:
            - 'Procurement'
            - 'Bid Invitation'
            - 'Request for Information'
            - 'Project Documentation'
            - 'Vendor Assessment'
    keywords_body:
        Body|contains:
            - 'urgent review'
            - 'attached specification'
            - 'submit proposal'
            - 'payment terms'
    condition: 1 of keywords_subject and 1 of keywords_body
falsepositives:
    - Legitimate procurement communication
level: medium


kql
// Hunt for network connections to known AiTM infrastructure domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "sohantraders.com", "satoriestate.com", "dueminital.uk", 
    "assessmentevaluationreport.com", "barifurniture.net", 
    "consistenthostinghub.de", "corporatetermscompliance.com", 
    "designenhancessatisfaction.de"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend FullUrl = "http://" ++ RemoteUrl


powershell
# PowerShell Hunt Script: Check DNS Cache for AiTM Domains
# Requires Administrator Privileges

$IoCList = @(
    "sohantraders.com",
    "satoriestate.com",
    "duemineral.uk",
    "assessmentevaluationreport.com",
    "barifurniture.net",
    "consistenthostinghub.de",
    "corporatetermscompliance.com",
    "designenhancessatisfaction.de"
)

Write-Host "[+] Checking DNS Cache for known AiTM Phishing Domains..." -ForegroundColor Cyan

$DnsCache = Get-DnsClientCache

foreach ($ioc in $IoCList) {
    $match = $DnsCache | Where-Object { $_.Entry -like "*$ioc*" }
    
    if ($match) {
        Write-Host "[!] ALERT: Found DNS Cache entry for $ioc" -ForegroundColor Red
        $match | Format-List Entry, Data, TimeToLive
    }
}

Write-Host "[+] Hunt complete. If alerts were found, investigate the user's browser history and recent authentication logs."

Response Priorities

Immediate

• Block IOCs: Immediately block all listed domains at the DNS forwarder, Web Proxy, and Firewall.
• Isolate Victims: If network traffic to these domains is detected in logs, isolate the affected endpoint and reset user credentials immediately.

24 Hours

• Session Revocation: For any user identified as interacting with these domains, revoke all active session tokens (OAuth refresh tokens) from the identity provider (e.g., Entra ID/Azure AD).
• Mailbox Audit: Investigate the email accounts of affected users for forwarding rules (often set up by adversaries to maintain access) and sent items for further lures.

1 Week

• Architecture Hardening: Implement conditional access policies that require compliant devices or trusted locations for procurement-related administrative tasks, if feasible.
• Awareness Training: Conduct targeted security awareness training for procurement and finance departments regarding the specific "Bid Invitation" and "Project Documentation" lures.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub