Social Engineering: Impersonation

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.^[3][4][5][6]

LAMEHUG has sent spearphishing emails impersonating Ukrainian government officials. ^[7]

APT41 impersonated an employee at a video game developer company to send phishing emails.^[8]

APT42 has impersonated legitimate people in phishing emails to gain credentials.^[9][10]

During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.^[11]

Contagious Interview had impersonated HR hiring personnel through social media, job board notifications, and conducted interviews with victims in order to entice them to download malware disguised as legitimate applications or malicious scripts from code repositories.^{[12][13][14][15][16][17][18][19]}

Kimsuky has also impersonated legitimate people, such as a foreign advisor, an embassy employee, and a think tank employee.^[20] Kimsuky has also purported to be a Japanese diplomat to communicate with the victims.^[21]

LAPSUS$ has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.^[22]

MirrorFace has sent targeted emails purporting to be from a Japanese political party’s PR department.^[23]

MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft.^[21] MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.^[24]

NPPSPY creates a network listener using the misspelled label logincontroll recorded to the Registry key HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order.^[25]

During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.^[26][27][28]

RustyWater has impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.^[24] 

Saint Bear has impersonated government and related entities in both phishing activity and developing web sites with malicious links that mimic legitimate resources.^[29]

During Salesforce Data Exfiltration, threat actors impersonated IT support personnel in voice calls with victims at times claiming to be addressing enterprise-wide connectivity issues.^[30][31]

Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens.^[32][33] Scattered Spider has also used Microsoft Teams to pose as internal IT support or help desk personnel.^[34]

Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.^[35][36][37]

Storm-1811 impersonates help desk and IT support personnel for phishing and social engineering purposes during initial access to victim environments.^[38]

VOID MANTICORE has impersonated individuals familiar to the victim and technical support associated with social messaging services.^[39]

WIRTE has used utilized look-alike domains and graphics of trusted security solution providers to entice victims to click on phishing links.^[40]

Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation.

Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in-person, to reduce risk.