Fighting Back Against Large-Scale Phishing Campaigns Targeting Swedish Municipalities, Regions ...

Fighting Back Against Large-Scale Phishing Campaigns Targeting Swedish Municipalities, Regions...

Speakers: Mathias Persson, Cybersecurity Specialist, CERT-SE

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=1lD8vyj5Y50

Overview

This talk, presented by Mathias Persson, a Cybersecurity Specialist at CERT-SE (the Swedish national coordinating CERT), delves into the anatomy and mitigation strategies for large-scale, sophisticated phishing campaigns that have targeted Swedish municipalities and regions over the past year and a half. The presentation highlights the evolving tactics of threat actors, the challenges faced by public sector organizations with varying levels of cybersecurity maturity, and the critical importance of national collaboration in responding to and remediating widespread incidents.

Persson's insights are drawn from CERT-SE's direct experience in coordinating responses to these persistent attacks. The campaigns leveraged compromised Microsoft 365 accounts, abusing legitimate cloud services like SharePoint and OneNote to facilitate credential harvesting and, in some cases, financial fraud and exfiltration of sensitive information related to critical infrastructure. The talk provides a detailed walkthrough of the attack chain and offers actionable guidance for defenders, making it highly relevant for cybersecurity professionals, incident responders, and policymakers in the public sector.

The significance of this talk lies not only in its technical breakdown of a prevalent threat but also in its emphasis on the operational challenges of incident response across a diverse public sector landscape. It underscores the necessity for national CERTs to provide practical, scalable guidance and to foster collaboration with local authorities to enhance overall cyber resilience. The lessons learned from Sweden's experience offer valuable insights for any nation grappling with similar large-scale cyber threats against its critical public services.

Background

▶ Watch: Introduction and CERT-SE's role in Sweden (0:00)

The campaigns described by Mathias Persson primarily focused on Sweden's municipalities, regions, and to some extent, schools. This sector presents unique challenges that threat actors readily exploit. There's a notable increased reliance on cloud services, particularly Microsoft 365, due to their ease of setup, lower infrastructure requirements compared to on-premise solutions, and perceived cost-effectiveness. However, this shift introduces new security considerations that many organizations are ill-equipped to handle.

A significant hurdle is the varying levels of security maturity across these public entities. While some regions boast well-staffed IT security teams and robust programs, many municipalities lack even a single dedicated IT security role. Persson cited a stark example where a municipality, post-breach, could only allocate one employee with a mere 25% focus on IT security. This disparity makes it difficult to implement consistent security postures and respond effectively to incidents. Furthermore, IT teams often struggle to secure financial support or backing from management to strengthen their defenses, exacerbating the problem.

The timeline of the attacks reveals an evolving threat landscape. The earliest signs of intrusion at a municipality were traced back to October 2023, with the first confirmed intrusion occurring in December 2023 against the same victim. This initial threat actor was described as "careful," attempting to remain undetected and primarily interested in sensitive information related to critical infrastructure. By December 2023 and January 2024, the victim municipality saw a surge in compromised Microsoft 365 accounts. An unconfirmed theory suggests that the initial access was sold, leading to a new actor taking over.

This second threat actor was less cautious but still tried to minimize their footprint. Their primary goal appeared to be financial, focusing on hijacking conversations related to invoices or payments. This actor successfully executed financial fraud at least once. The activity continued until May 2024, when access was believed to have been sold again to a third threat actor. This latest actor showed little regard for opsec, adopting a "shotgun approach" with mass phishing emails sent from compromised accounts. This phase, starting around June 2024, led to widespread account compromises across multiple municipalities, catching the attention of CERT-SE in mid-June and subsequently the news agencies by July.

CERT-SE, as the national coordinating CERT in Sweden, plays a crucial role in this context. Its mission involves supporting constituents in mitigating and remediating cybersecurity incidents. Their services include technical analysis of malware and logs, incident management advice, coordination of resources, and publishing recommendations. CERT-SE also offers free services like ANTS (Automatic Notifications of Technical Vulnerabilities), which warns organizations about misconfigured services, DDoS vulnerabilities, or potential botnet compromises. In February 2024, they launched a national malware information sharing platform to enhance intelligence correlation and insight into the Swedish threat landscape, further underscoring their commitment to proactive defense and collaboration.

Key Findings

▶ Watch: Overview of the 5-step Phishing Attack Chain (6:00)

The comprehensive analysis by CERT-SE uncovered several critical findings regarding these large-scale phishing campaigns. A primary observation was the evolution of threat actor tactics. Initially, a stealthy actor focused on information gathering, particularly concerning critical infrastructure. This evolved into financially motivated attacks, characterized by invoice fraud, and finally escalated into aggressive, mass-scale phishing campaigns with little regard for operational security. This progression suggests a potential "access-as-a-service" model, where initial compromises are sold to subsequent actors with different objectives.

A central theme was the pervasive use of Microsoft 365 account compromise as the primary entry vector. Threat actors consistently targeted M365 credentials, leveraging the widespread adoption of these cloud services within the public sector. Crucially, the campaigns demonstrated a sophisticated understanding of how to abuse legitimate cloud services like SharePoint, OneDrive, and OneNote. Instead of hosting malicious content on external, easily blocked domains, phishing links led to legitimate OneNote documents hosted on the victim organization's own SharePoint, significantly aiding in bypassing standard email security filters.

The campaigns employed various persistence mechanisms to maintain access and hide their activities. Threat actors consistently created mail rules within compromised mailboxes, often redirecting responses to phishing emails to obscure folders like RSS feeds, archives, or even the trash, thereby minimizing detection by the legitimate user. In some cases, actors were observed adding new MFA methods for the compromised user, creating an alternative means of authentication. Additionally, there was at least one instance of a legitimate mailbox backup application being added to a tenant to exfiltrate an entire mailbox for offline viewing, highlighting a more advanced exfiltration technique.

The financial impact of these attacks was tangible. In at least one documented case, threat actors successfully executed financial fraud by hijacking old conversations and altering invoice amounts and IBAN numbers, resulting in a loss of 145,000 Swedish Kronor, equivalent to approximately 14,000 EUR or USD. This demonstrates the direct monetary consequences beyond mere data exposure.

The scale and scope of the attacks were significant, with up to 7,000 phishing emails observed being sent from a single compromised account in some instances. This led to widespread account compromises across numerous municipalities, underscoring the "shotgun approach" adopted by the third threat actor. The consistent modus operandi across multiple incidents facilitated CERT-SE's recognition of a coordinated campaign.

Finally, a key finding emerged from the remediation efforts: insufficient measures and a general lack of knowledge/experience within many victim organizations contributed to the persistence of incidents. This realization prompted CERT-SE to develop and distribute comprehensive, actionable guidance, recognizing that generic security advice was often not enough for organizations with limited resources and expertise. The subsequent decrease in incidents related to these phishing attacks, observed since the beginning of 2024 after the guidance was distributed, suggests the effectiveness of a coordinated, practical response.

Technical Deep Dive

▶ Watch: Financial fraud and MFA bypass methods observed (12:00)

The attack chain observed by CERT-SE was highly structured, leveraging legitimate cloud infrastructure to evade detection. It comprised five distinct steps, each designed to maximize the likelihood of compromise and persistence.

The first step was User Compromise, typically initiated through a phishing email. These emails, while not "particularly advanced," were effective due to their close imitation of regular internal communications. They featured correct language and often contained a SharePoint link that, crucially, led to a OneNote document hosted on the victim organization's own SharePoint. This tactic bypassed many email security tools that might flag external malicious links.

Following initial access, the threat actor would proceed with enumeration of the system and the user's mailbox. This involved searching for sensitive and classified information, particularly related to critical infrastructure. In a more insidious move, actors also examined vacation schedules of key personnel to identify opportune moments for impersonation, increasing the success rate of subsequent phishing or fraud attempts. A notable exfiltration technique involved the abuse of legitimate mailbox backup applications to entirely exfiltrate a user's mailbox for offline analysis, suggesting a desire for comprehensive data access without continuous online presence.

The third step was the creation of mail rules within the compromised mailbox. These rules were designed to hide incoming responses to the phishing emails, thus preventing the legitimate user from noticing the malicious activity. Examples included rules that marked emails from specific addresses (e.g., "moira.se" or a Dutch email address) as read and moved them directly to the RSS feeds folder, the archive, or the trash. These rules were often subtly named (e.g., a simple "dot") to avoid suspicion.

The fourth and most innovative step involved setting up a new OneNote document in SharePoint. These documents were hosted on the victim's legitimate SharePoint environment, making the initial link appear trustworthy. The OneNote documents were usually named something generic like "IT" and contained simple, well-formatted content, often with the correct signature of the compromised user. Critically, embedded within this legitimate OneNote document was another hyperlink, typically labeled "view document," which led to the actual attacker-controlled phishing portal. CERT-SE observed cases where the SharePoint links didn't even belong to the compromised user's organization but to another compromised entity, indicating resource sharing or reuse of access by the threat actor.

Finally, the phishing email itself was crafted. It contained the legitimate SharePoint link pointing to the malicious OneNote document and was often broadly distributed to a list of users selected by the threat actor. Distribution numbers varied, but some campaigns involved sending up to 7,000 emails. When a recipient clicked through the SharePoint link and then the embedded hyperlink in the OneNote document, they landed on the threat actor's phishing portal. These portals were often protected by CAPTCHAs to deter automated scanning tools and bots. The portals were designed to meticulously mimic legitimate Microsoft 365 login pages, often showing a blurred invoice in the background to create a sense of urgency. Users were prompted for their email, then their password. Upon submission, credentials were sent to the threat actor's server, and the user was immediately redirected to Microsoft's legitimate office.com, implying a benign error. CERT-SE noted almost instant login attempts using harvested credentials, indicating automated validation and checks for Multi-Factor Authentication (MFA) status.

A more advanced variant of credential harvesting observed was Adversary-in-the-Middle (AiTM) phishing, utilizing frameworks such as Tycoon 2FA or Evil Proxy. These frameworks are capable of capturing not only user credentials but also MFA tokens, effectively bypassing traditional MFA protections. Beyond credential harvesting, the threat actors engaged in financial fraud by hijacking existing email conversations, altering invoice amounts, and changing IBAN numbers to redirect payments to accounts controlled by the attackers. This resulted in at least one successful fraud totaling 145,000 SEK.

Demo / Proof of Concept

▶ Watch: Collaborating for scalable remediation guidance distribution (14:00)

The talk by Mathias Persson did not include a live demonstration or a proof of concept developed by CERT-SE. Instead, the presentation meticulously detailed the observed attack chain through a series of examples and screenshots derived directly from the real-world incidents CERT-SE investigated. These visual aids illustrated the appearance of the phishing emails, the structure of the malicious mail rules, and the design of the attacker-controlled phishing portals, providing concrete evidence of the techniques employed by the threat actors. The focus was on analyzing and explaining the actual methods used in the large-scale campaigns against Swedish municipalities and regions, rather than showcasing a simulated attack.

Defensive Implications

▶ Watch: Q&A: Mandate limitations on remediation actions (22:00)

In response to the persistent nature of these incidents, CERT-SE recognized that existing remediation efforts were often insufficient. To address this, they developed a comprehensive, nine-step guidance document for organizations to effectively remediate compromised Microsoft 365 accounts and ensure threat actors were expelled and denied re-entry.

The remediation steps are designed to be executed chronologically:

1. Deactivate the user account: This immediately cuts off the threat actor's access.
2. Revoke the user's active sessions: While access tokens are valid for an average of 75 minutes and cannot be revoked instantly without Continuous Access Evaluation (CAE), revoking the refresh token prevents the actor from requesting new access tokens once the current one expires. Organizations must continue to monitor for suspicious activity until the original access token is no longer valid.
3. Revoke the user's MFA session: This forces a new MFA authentication prompt for any actions requiring it.
4. Check for and remove any new MFA methods: Threat actors often add their own MFA methods for persistence. If found, these must be removed. If deemed necessary, all MFA methods should be removed, and the user should re-enroll MFA once the account is reactivated.
5. Check for and remove any new applications: Depending on the organization's application policy, threat actors might add legitimate but malicious applications (e.g., mailbox backup applications, as observed) to the tenant. These must be removed, and their permissions revoked.
6. Expand the investigation: If the compromised user had high-privilege roles or RBAC assignments, the investigation must be broadened to check for lateral movement or pivoting to adjacent systems.
7. Check for and remove any malicious mail rules: These rules, often subtly named (e.g., a simple "dot"), are designed to hide phishing responses and must be identified and removed.
8. Remove the malicious OneNote document and associated SharePoint sites: This is a crucial step to limit the consequences for recipients of the phishing email. Taking down the malicious document ensures that anyone clicking the SharePoint link will encounter an error instead of being led to the phishing portal.
9. Reset the user's password and activate the user account: If passwords are synced from an on-premise Active Directory, this step needs to be performed twice due to caching mechanisms.
10. Inform any recipients of the phishing email: This helps limit further spreading and potential compromise of more accounts.
11. Continue to monitor user activity: Post-remediation, ongoing monitoring is essential to ensure no further suspicious activity occurs.

The distribution of this guidance was a key success factor. Recognizing the scalability challenge of reaching 290 municipalities and 21 regions individually, CERT-SE partnered with SKR (Swedish Association of Local Authorities and Regions). SKR, a national member and employer organization representing Sweden's municipalities and regions, provided the necessary outreach capacity, established trust, and contact information. They leveraged their voluntary network, Kompetens i samverkan (Competence Community), composed of IT staff from municipalities, to review and test the material, ensuring its relevance and practicality. This collaborative approach ensured the guidance reached its target audience effectively.

Persson emphasized several broader lessons learned for defenders:

• Actionable Guidance: The community has a responsibility to provide specific, step-by-step guidance rather than generic advice (e.g., "secure your systems"). Many organizations lack the expertise to translate broad statements into concrete actions.
• Collaboration is Key: Fighting evolving cyber threats requires strong collaboration with established authorities and important actors within a constituency. This extends reach, capabilities, and leverages collective knowledge. CERT-SE's partnership with SKR is a prime example of this success.
• Building Resilience: Organizations must find ways to work together to build resilience and strengthen defenses. Collaboration fosters trust, which in turn leads to better information sharing and a more robust collective defense.
• Understanding the Threat Landscape: Maintaining close ties with constituents is vital for staying up-to-date with changes in the cyber threat landscape, both nationally and globally.

The observed decrease in phishing-related incidents against municipalities and regions since the guidance distribution underscores the effectiveness of a coordinated, practical, and collaborative defensive strategy.

Key Takeaways

• Evolving and Sophisticated Phishing Tactics: Phishing campaigns against the public sector are dynamic, evolving from stealthy information gathering to aggressive financial fraud and mass-scale credential harvesting. Threat actors skillfully leverage legitimate cloud services like Microsoft 365, SharePoint, and OneNote to bypass traditional security controls.
• Abuse of Legitimate Cloud Infrastructure: A critical aspect of these attacks is the abuse of an organization's own legitimate cloud infrastructure (e.g., hosting malicious OneNote documents on SharePoint) to make phishing links appear trustworthy and evade detection by email security tools.
• Comprehensive Remediation is Essential: Simple password resets are insufficient. Effective incident response requires a multi-faceted approach, including immediate user deactivation, revoking all active sessions and MFA methods, checking for and removing malicious applications and mail rules, and critically, taking down the malicious content hosted on legitimate internal systems.
• The Power of Collaboration: National CERTs and governmental bodies must actively collaborate with local authorities and IT communities (as demonstrated by CERT-SE's partnership with SKR) to ensure widespread distribution of actionable guidance, leverage collective expertise, and build national cyber resilience.
• Prioritize Advanced Defensive Measures: Organizations must implement robust MFA and consider adopting Continuous Access Evaluation (CAE) to mitigate advanced phishing techniques like Adversary-in-the-Middle (AiTM), which can bypass traditional MFA by capturing MFA tokens.
• Tailored, Actionable Guidance is Crucial: Given the varying levels of cybersecurity maturity and resource constraints within the public sector, generic security advice is often ineffective. There is a clear need for specific, step-by-step, and practical guidance that organizations can directly implement to improve their defensive posture and incident response capabilities.

About the Speaker(s)

Mathias Persson is a Cybersecurity Specialist at CERT-SE, the national coordinating CERT in Sweden, a role he has held for the past two years. Before joining CERT-SE, Mathias accumulated over a decade of experience in system administration, primarily serving at the Swedish Armed Forces. His background encompasses both military service as a soldier and civilian employment in IT within the armed forces, providing him with a robust understanding of critical systems and operational security challenges. He brings this extensive practical experience to his current role, focusing on mitigating and remediating cybersecurity incidents across Sweden's public sector.