THREAT OPS › Threat News › Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain
Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain
<h1>Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain</h1> <p>The SOCRadar Threat Research Unit (STRU) has conducted an “inside-out” analysis of <strong>AnonyMousKIT</strong>, an <strong>AI-powered Phishing-as-a-Service (PhaaS)</strong> ecosystem specifically engineered to disable <strong>Apple</strong>’s Activation Lock on stolen devices. Operating as a credit-metered platform, AnonyMousKIT au
MITRE ATT&CK techniques
- Acquire InfrastructureT1583
- VulnerabilitiesT1588.006
- Spearphishing LinkT1566.002
- Spearphishing LinkT1598.003
- Application Layer ProtocolT1071
- Email AccountsT1586.002
- DomainsT1583.001
- Social EngineeringT1684
- Control PanelT1218.002
- Gather Victim Identity InformationT1589
- Email AccountsT1585.002
- Virtual Private ServerT1583.003
- Stage CapabilitiesT1608
- Link TargetT1608.005
- Financial TheftT1657
- Spearphishing AttachmentT1598.002
- User ExecutionT1204
- Exfiltration Over C2 ChannelT1041
- ToolT1588.002
- PhishingT1566
- Multi-Factor AuthenticationT1556.006
- CredentialsT1589.001
- Phishing for InformationT1598
- ImpersonationT1684.001
- Establish AccountsT1585
- Obtain CapabilitiesT1588
- Multi-Factor Authentication InterceptionT1111
- Web ProtocolsT1071.001
- Develop CapabilitiesT1587
- Malicious LinkT1204.001
- Acquire InfrastructureAML.T0008
- Malicious LinkAML.T0011.003
- Obtain CapabilitiesAML.T0016
- Develop CapabilitiesAML.T0017
- Establish AccountsAML.T0021
- System PromptAML.T0069.002
- ImpersonationAML.T0073
- Stage CapabilitiesAML.T0079
- Gather Victim Identity InformationAML.T0087
Indicators of compromise
- 5ea22f9777a34f461840c2a3988c717c0f9e6ec4bd95420c8643251e28ccc36bsha256
- d9e2881d3aa1ea40928dac65405fbe7e36989cad51ab46daf493afff757a2493sha256
- 32fa60c9099f53f194a6a63c9341dd115434584e0890120ba1eca83ae33832bfsha256
- 07d4a6ac925f9f7e63c7332df1995de03f514931e9d97cb3dd7a72fecf569e11sha256
- 2c790296b404b3e7592da37b15311507b0e55989e1628eef1bb970acb13ec37fsha256
- https://urlscan.io/search/#hash%3Ad9e2881d3aa1ea40928dac65405fbe7e36989cad51ab46daf493afff757a2493url
- https://urlscan.io/search/#page.title%3A%22Ger%C3%A4te%20finden%20-%20Apple%20iCloud%22url
- https://platform.socradar.com/app/threat-huntingurl
- xgodauth@gmail.comemail
- 75.119.135.83ipv4
- 27.34.73.22ipv4
- 27.34.73.46ipv4
- 197.235.0.0ipv4
- 5.90.0.0ipv4
- 5.91.0.0ipv4
- 181.170.142.0ipv4
- 196.196.102.74ipv4
- 197.235.0.0/16cidr
- 5.90.0.0/16cidr
- 5.91.0.0/16cidr
- 181.170.142.0/24cidr
- i-cloudsd.comdomain
- smtp.gmail.comdomain
- smtp.mail.me.comdomain
- apple-login-imaps.comdomain
- apple-thailand.codomain
- kanoondekho.comdomain
- irealm-server.codomain
- findmy-dispositivos.comdomain
- rastreo-devices.comdomain
- fmi-dispositivos.comdomain
- com-maps.infodomain
- find-alerts.comdomain
- fmi-dispositivo.comdomain
- findmylocalizado.comdomain
- za.comdomain
- sa.comdomain
- projectpartapple.comdomain
- uktservice.sa.comdomain
- center-one.onlinedomain
Original source: https://socradar.io/blog/anonymouskit-ai-phaas-supply-chain/