Microsoft analyzes methods: Powerful phishing service provider busted

Microsoft discovers a criminal network that makes gigantic profits with a phishing service. The masterminds behind "BulletProofLink" are probably responsible for many of the current phishing attacks with email spam and are cashing in big time.

Email spam is not only incredibly annoying, it is also dangerous. This is because the fake messages are used by gangsters to try to capture sensitive data from users, such as passwords or account information. Companies are often the target of phishing attacks in order to blackmail or spy on them.

One criminal group is currently apparently responsible for a particularly large number of attacks on companies, offering a thriving phishing service under the name "BulletProofLink". Microsoft's security department has analyzed how far this goes and what methods the gangsters use.

In principle, the group acts like a clever legal service provider. It offers construction kits, email templates, hosting and automated services. Among other things, "BulletProofLink" has over 100 phishing templates in its portfolio, and in one go the gangsters can quickly set up more than 300,000 subdomains for a campaign.

"Unique services for dedicated spammers".

The gangsters have been active since 2018. They maintain several websites under their aliases "BulletProftLink," "BulletProofLink" and "Anthrax." These include YouTube and Vimeo pages with instructions. They also advertise on various forums.

The group advertises their offer as "unique services for every dedicated spammer". Those who want to take advantage of the service simply sign up at the "BulletProofLink" online store. The group offers a 10 percent discount for the first order or subscription to its newsletter.

Wire-pullers cash in twice

Customers can buy phishing kits, which "BulletProofLink" usually offers as ZIP files. This enables them to build up their own campaign in a modular system. However, the offer also includes an all-round carefree package, in which the group takes care of everything from e-mail templates to hosting to the analysis of captured data. This is called Phishing-as-a-Service (PhaaS).

"BulletProofLink's" customer base is apparently quite large. According to Bleeping Computer, the phishing service's ICQ group chat had 1618 members last year. The prices are cheap, the masterminds make money with mass. Monthly subscriptions are available for as little as $800, and a one-time hosting link costs $50.

But this is not the only income of the gangsters. They often also sell the captured data or use it to blackmail phishing victims. Of course, "BulletProofLink" also accepts Bitcoins as a means of payment.

Network not dismantled so far

Even though the gangsters market their phishing service quite openly, it is not easy to put a stop to them. Among other things, they are able to create any number of subdomains with unique addresses. Thus, they fall through the cracks of usual detection methods, which are based on the exact match of domains and URLs.

Microsoft has been able to analyze the gangsters' methods and tools, but has not yet been able to dismantle their network. Currently, "BulletProofLink" continues to carry out active phishing campaigns in which a large number of passwords are tapped, according to the security researchers' blog entry.