Key Points
- The phishing emails were sent globally and were in Japanese
- The email poses as the legitimate entity “Ekinet” in an attempt to scam victims into navigating to the URL in the email.
- The emails are normally sent in Japanese.
Summary of Campaign
The phishing campaign impersonates Ekinet, a Japanese based organization that is used to reserve train tickets. The campaign attempts to lure victims to a malicious website and then makes them input their credit card or other personal information. The Council of Anti-Phishing in Japan released an alert earlier in 2022 detailing potential scams using Ekinet. From the emails we have seen, the text is usually always in Japanese and recently an email was reported on a United States based organizations inbox.
It was reported by the Information Technology Center, The University of Electro-Communications in Japan that there were multiple different emails from this campaign that have been sent to their campus on December 6, 2022, but they are all from the same sender.
The Lure
The messaging is in Japanese and attempts to lure victims into clicking on a malicious URL that is then used to store credit card information or other personal information should the victim fall for the scam. The premise of the email that was detected in a customers’ inbox was to lure the victim into clicking on a URL that would redirect them to a phishing site by stating their account would be terminated if they did not verify their login.
The below image shows the email seen in our customers’ inbox:
Detections
The SafeGuard Cyber platform can do this through a novel machine learning-based model that detects social engineering attacks, phishing scams, spoofed email workflows, and more through NLU across communication channels.
This detection model identifies potential threats through scanning for and identifying various determinants and critical attributes of content and text that suggest a social engineering attempt has been made. The image below shows how SafeGuard Cyber detects the email.
Talk to our experts here to learn more about the SafeGuard Cyber platform and how you can protect yourself from scams such as this one.
IOCs:
– URL: hxxps://jdmzzs[.]cn/pJUQGCw
– IP: 34.92.139.231
– Sender: info@jreast.co.jp
If you are interested in learning more about the SafeGuard Cyber solution, you can take a quick 5-minute tour.
