Manufacturing Sector Is the Latest Target of Advanced Credential Harvesting Attacks

A new attack runs slow and steady, focused on compromising large manufacturing companies using contextual social engineering to trick victims into giving up credentials.

When you read about an attack only targeting 15 companies over the span of six months, you’d likely ignore it given its smalls scale.

But the analysis of this phishing attack by cybersecurity vendor BlueVoyant’s Threat Fusion Cell paints a picture of a well thought out campaign to trick manufacturing organization users into providing their Microsoft 365 credentials.

The attack begins with an email containing an attachment named something close to “Product List RFQ, NDA & Purchase Terms 2024.shtml.” The emails impersonate two well-known large companies, Periscope Holdings (a large procurement solutions company serving the public sector), and R.S. Hughes (a North American distributor of industrial and safety supplies).

The attachment’s file extension tells you everything you need to know about the attack – it’s an HTML document that spoofs a Microsoft 365 login page. A simple enough attack, but it’s BlueVoyant’s commentary that should have manufacturing orgs worried:

The low volume of identified campaign artifacts, highly narrow target selection within North America and the advanced manufacturing industry, and the creation of look-alike domains that lay dormant for several months after registration suggest an advanced adversary. 

Users that undergo continual security awareness training are already mindful of HTML attachments and being asked to provide Microsoft 365 credentials when it’s not necessary. Manufacturing orgs should be concerned… that is, unless their users remain vigilant when interacting with email and the web.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.