{"id":341,"date":"2019-10-28T00:00:00","date_gmt":"2019-10-28T00:00:00","guid":{"rendered":"https:\/\/cyberthreatintelligencenetwork.com\/index.php\/2019\/10\/28\/the-mill-taste-campaign\/"},"modified":"2024-06-23T23:06:27","modified_gmt":"2024-06-23T23:06:27","slug":"the-mill-taste-campaign","status":"publish","type":"post","link":"https:\/\/cyberthreatintelligencenetwork.com\/index.php\/2019\/10\/28\/the-mill-taste-campaign\/","title":{"rendered":"The “Mill Taste” Campaign"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>

An active phishing campaign is being propagated from a Spanish-themed domain name that alludes to El Molino Sabor (in English: \u201cMill Taste\u201d) and shows a close-up of a Sweet Potato or Yam on the landing page of the website.\u00a0 The social engineering approach is an email from an \u201cAccounting Manager\u201d by the name of \u201cMelissa Henry\u201d who is sending a \u201ccopy\u201d of a paid invoice.\u00a0 In fact, it has attached a PDF and is coming with the subject line: Paid Invoice TT Copy. Based on my link analysis the PDF is infected with malware which will be described below.<\/p>

Phishing Campaign Cyber Observables<\/strong><\/h3>

The phishing domain is:\u00a0 elmolinosabor[.]com<\/p>

The phishing IP is:\u00a0 146.112.61[.]107<\/p>

Recent DNS History<\/strong><\/h3>

The threat actor appears to have begun building his infrastructure on February 1, 2019 using an admin panel labeled \u201cl5fa7189.justinstalledpanel.com\u201d at IP: 94.102.60.165.\u00a0 From the DNS history tracked by [redacted<\/em><\/span>] it appears that the initial test run of the malicious infrastructure was on June 5th<\/sup> and 8th<\/sup> from www1-royalbank[.]cc and www1royalbank-petrocanada[.]com, respectively.<\/p>

The same Splash page for all three of these events is showing as the same \u2018Welcome!\u2019 placeholder.<\/p>

According to the [redacted<\/span><\/em>] tool the autonomous system network for the above noted IP is:\u00a0 AS202425 which is exhibiting multiple security issues including:<\/p>