A security threat group used more than 16 domains and 300 websites to create bogus login screens for 76 different universities in an attack that spanned 14 countries.

Investigators at SecureWorks said victims who were exposed to the URL spoofing attack were redirected from the phony webpages to real login screens where they could enter their usernames and passwords and give threat actors access to online library systems.

A security threat group called COBALT DICKENS, reportedly based in Iran, is believed to be responsible for the attack. Targeted organizations include universities based in the U.S., Canada, the U.K., Turkey, Australia, China, Japan, Israel and Switzerland.

Security Threat Group Steals From the Brightest Minds

Cybercriminal activity has often been focused on sectors, such as financial services, where the potential to gain access to user accounts offers an obvious profit motive. In this case, SecureWorks’ researchers suggested that the threat group might have been trying to compromise universities’ online libraries to steal valuable intellectual property that has yet to be commercialized.

Many large enterprises help fund major research and development projects through university partnerships, for example, but postsecondary institutions may not offer the same level of identity and access management (IAM) protection as organizations operating in other sectors. That could make a security threat group such as COBALT DICKENS look at universities as low-hanging fruit to gain access to corporate secrets before they’re patented or put into production.

How to Improve IAM With Silent Security

To fend off the efforts of threat groups like COBALT DICKENS, IBM experts suggest implementing silent security tools, which may include everything from cross-application single sign-on (SSO) to cloud-based identity-as-a-service (IDaaS) tools.

With these technologies and analytics running in the background, employees can continue to log on to the systems and other resources they need, and their security team is only alerted when there is some kind of anomaly, such as a potentially spoofed URL.

As with many other threats, security teams should also block all URL and IP-based indicators of compromise (IoCs) at the firewall, router or other perimeter-based device.

Source: SecureWorks