{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "credential phishing through lookalike domains bypasses endpoint malware detections by serving legitimate binaries. This hunt detects the full access chain to identify compromised credentials." }, "name": "WatchGuard VPN Lookalike Phishing and Payload Delivery", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1195.002", "attack.t1133", "credential access", "execution", "initial access" ], "series": { "slug": "fake-watchguard-vpn-site-steals-credentials", "index": 1, "title": "Fake WatchGuard VPN Site Steals Credentials", "total": 2 }, "related": [ { "hunt": "external-service-login-anomaly", "reason": "This hunt identifies the theft; the follow-on identifies the use of stolen credentials.", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A detection rule would only trigger on a legitimate binary name. This hunt provides the necessary context by correlating the preceding SEO redirect and phishing lure interaction with the download.", "coverage": [ { "stage": "seo-poisoning-redirection", "steps": [ "http-lure-activity" ], "status": "covered" }, { "stage": "lure-site-access", "steps": [ "scoping-dns-lookups", "http-lure-activity", "network-infra-hits" ], "status": "covered" }, { "stage": "credential-harvesting", "steps": [ "http-lure-activity", "network-infra-hits" ], "status": "covered" }, { "stage": "legitimate-payload-delivery", "steps": [ "installer-file-events", "installer-execution-events" ], "status": "covered" }, { "stage": "external-service-login", "reason": "Belongs to another part of the 'Fake WatchGuard VPN Site Steals Credentials' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "SEO Poisoning Redirection", "slug": "seo-poisoning-redirection", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "bing.com/ck/a", "u=aHR0cHM6Ly93d3cud2F0Y2hndWFyZC12cG4ubmV0Lw", "search query: watchguard vpn sll download" ] }, { "name": "Phishing Lure Site Access", "slug": "lure-site-access", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "watchguard-vpn.net", "watchguard-vpn.com", "80.249.132.140", "74.208.236.39", "www.watchguard-vpn.net/index.php" ] }, { "name": "Credential Harvesting", "slug": "credential-harvesting", "tactic": "credential-access", "techniques": [ "T1566" ], "observables": [ "popup.js", "JSON POST to watchguard-ssl.online", "158.94.209.19", "fields: server, login, password, attempt", "Incorrect data, please enter again to start installation" ] }, { "name": "Legitimate Payload Delivery", "slug": "legitimate-payload-delivery", "tactic": "execution", "techniques": [ "T1195.002" ], "observables": [ "cdn.watchguard.com", "WG-MVPN-SSL_12_11_5.exe", "SHA256: fb3c39ba...0032ac1f", "WatchGuard Technologies, Inc. (Inno Setup)" ] }, { "name": "External Remote Service Access", "slug": "external-service-login", "tactic": "initial-access", "techniques": [ "T1133" ], "observables": [ "VPN login from hosting provider IPs", "VPN login from unfamiliar ASNs", "SSL VPN login for WatchGuard client" ] } ], "summary": "The Storm-2561 campaign uses SEO poisoning on search engines like Bing to direct users to lookalike VPN download sites. These sites harvest credentials through a multi-stage JavaScript prompt before delivering a legitimate, signed WatchGuard installer to avoid suspicion. Stolen credentials are then utilized for unauthorized access to external remote services." }, "severity": "high", "rationale": "Focus on endpoints that performed searches for VPN software or resolved the phishing domains identified in the DNS scoping step.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using SEO poisoning to lead users to fake WatchGuard VPN download sites that harvest credentials via a JavaScript modal before delivering the legitimate, signed installer.", "parameters": { "lure_ips": { "from": { "ref": "Huntress Blog 2026-10-13", "kind": "article", "observed": "2026-10-13" }, "type": "list[ip]", "default": [ "80.249.132.140", "74.208.236.39", "158.94.209.19" ], "description": "IP addresses hosting lure sites and credential collectors." }, "lure_paths": { "from": { "ref": "Huntress Blog 2026-10-13", "kind": "article", "observed": "2026-10-13" }, "type": "list[path]", "default": [ "/index.php", "/popup.js" ], "description": "Specific URL paths associated with the credential harvesting modal." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to narrow the search; leave empty to search all." }, "lure_domains": { "from": { "ref": "Huntress Blog 2026-10-13", "kind": "article", "observed": "2026-10-13" }, "type": "list[domain]", "default": [ "watchguard-vpn.com", "watchguard-vpn.net", "www.watchguard-vpn.net", "watchguard-ssl.online" ], "description": "Lookalike and collection domains associated with the campaign." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "installer_name": { "type": "string", "default": "WG-MVPN-SSL_12_11_5.exe", "description": "The name of the legitimate WatchGuard installer delivered as a payload." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing", "name": "Huntress \u2014 Fake WatchGuard VPN Site Steals Credentials" } ], "blind_spots": [ { "id": "no-http-path-visibility", "risk": "Without path visibility, interaction with the modal must be inferred from the follow-on installer download.", "stage": "lure-site-access", "question": "Did the user reach the popup.js specifically?", "requires": "hb_http_activity with full URI paths" }, { "id": "encrypted-credential-post", "risk": "POST requests to watchguard-ssl.online indicate intent, but content is not visible.", "stage": "credential-harvesting", "question": "Were credentials actually transmitted?", "requires": "TLS inspection at the proxy" } ] }, "name": "WatchGuard VPN Lookalike Phishing and Payload Delivery", "description": "This hunt identifies hosts that interacted with lookalike WatchGuard VPN domains identified in recent threat research. The attack chain involves a redirection from search engines like Bing, interaction with a phishing lure site, and a forced credential entry prompt. The hunt first identifies candidate hosts via DNS activity, then examines HTTP and network traffic to identify lure interaction and credential POSTing. Finally, it correlates this activity with the subsequent download and execution of the legitimate WatchGuard SSL VPN installer, which is used to mask the theft and satisfy the user's original intent." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "fake-watchguard-vpn-site-steals-credentials", "index": 1, "title": "Fake WatchGuard VPN Site Steals Credentials", "total": 2 }, "coverage": [ { "stage": "seo-poisoning-redirection", "steps": [ "http-lure-activity" ], "status": "covered" }, { "stage": "lure-site-access", "steps": [ "scoping-dns-lookups", "http-lure-activity", "network-infra-hits" ], "status": "covered" }, { "stage": "credential-harvesting", "steps": [ "http-lure-activity", "network-infra-hits" ], "status": "covered" }, { "stage": "legitimate-payload-delivery", "steps": [ "installer-file-events", "installer-execution-events" ], "status": "covered" }, { "stage": "external-service-login", "reason": "Belongs to another part of the 'Fake WatchGuard VPN Site Steals Credentials' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using SEO poisoning to lead users to fake WatchGuard VPN download sites that harvest credentials via a JavaScript modal before delivering the legitimate, signed installer.", "blind_spots": [ { "id": "no-http-path-visibility", "risk": "Without path visibility, interaction with the modal must be inferred from the follow-on installer download.", "stage": "lure-site-access", "question": "Did the user reach the popup.js specifically?", "requires": "hb_http_activity with full URI paths" }, { "id": "encrypted-credential-post", "risk": "POST requests to watchguard-ssl.online indicate intent, but content is not visible.", "stage": "credential-harvesting", "question": "Were credentials actually transmitted?", "requires": "TLS inspection at the proxy" } ], "scoping_notes": "Focus on endpoints that performed searches for VPN software or resolved the phishing domains identified in the DNS scoping step.", "beyond_detection": "A detection rule would only trigger on a legitimate binary name. This hunt provides the necessary context by correlating the preceding SEO redirect and phishing lure interaction with the download." } }, { "id": "scoping-dns-lookups", "type": "query", "label": "Scope hosts by DNS lookups to lure domains", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, (SELECT COUNT(DISTINCT device_hostname) FROM hb_dns_activity WHERE LOWER(query_hostname) = LOWER(d.query_hostname) AND time >= datetime('now', '-{{lookback_days}} days')) AS host_prevalence, MIN(time) AS first_seen FROM hb_dns_activity d WHERE instr(',' || '{{lure_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Identify any hosts that attempted to resolve the lookalike or collector domains to narrow the investigation and provide prevalence context.", "expected_signal": "Hosts resolving the phishing domains. Host prevalence shows if a domain is unique to one user or common across the fleet." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope hosts by DNS lookups to lure domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, (SELECT COUNT(DISTINCT device_hostname) FROM hb_dns_activity WHERE LOWER(query_hostname) = LOWER(d.query_hostname) AND time >= datetime('now', '-{{lookback_days}} days')) AS host_prevalence, MIN(time) AS first_seen FROM hb_dns_activity d WHERE instr(',' || '{{lure_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "silence": "evidence_of_absence", "expected": "Hosts resolving the phishing domains. Host prevalence shows if a domain is unique to one user or common across the fleet.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "http-lure-activity", "type": "query", "label": "Search for search-redirects and lure URI hits", "config": { "dsl": "sqlite", "role": "triage", "source": "web", "content": "SELECT device_hostname, actor_user_name, url_hostname, url_path, referrer, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{lure_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND (LOWER(referrer) LIKE '%bing.com%' OR LOWER(referrer) LIKE '%google.com%') AND (instr(',' || '{{lure_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR url_path = '/') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Find HTTP evidence of the SEO redirection from search engines and interaction with the harvesting infrastructure.", "expected_signal": "HTTP requests showing the user arriving at a lure domain from a search engine and interacting with index.php or popup.js." }, "parents": [ { "id": "scoping-dns-lookups" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Search for search-redirects and lure URI hits", "reads": [ "actor_user_name", "device_hostname", "referrer", "time", "url_hostname", "url_path" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, actor_user_name, url_hostname, url_path, referrer, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{lure_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 AND (LOWER(referrer) LIKE '%bing.com%' OR LOWER(referrer) LIKE '%google.com%') AND (instr(',' || '{{lure_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR url_path = '/') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "HTTP requests showing the user arriving at a lure domain from a search engine and interacting with index.php or popup.js.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "network-infra-hits", "type": "query", "label": "Network connections to malicious IPs", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{lure_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Corroborate HTTP hits with raw network traffic to known lure and collection IPs.", "expected_signal": "Connections from browser processes to the reported IP addresses." }, "parents": [ { "id": "scoping-dns-lookups" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Network connections to malicious IPs", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{lure_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Connections from browser processes to the reported IP addresses.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Triage early-stage phishing interaction", "config": { "cite": "required", "tools": [ "endpoint", "network", "web" ], "context": [ "scoping-dns-lookups", "http-lure-activity", "network-infra-hits" ], "objective": "Identify hosts that reached the credential harvesting page and extract the actor_user_name from the HTTP telemetry to pinpoint the victim.", "description": "Assess whether the scoped hosts navigated the phishing lure and identify the user account involved.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether the initial access phase was completed.", "success_criteria": "A list of hosts and specific user accounts with confirmed phishing lure interactions." }, "parents": [ { "id": "http-lure-activity", "kind": "merge" }, { "id": "network-infra-hits", "kind": "merge" } ] }, { "id": "installer-file-events", "type": "query", "label": "Detection of installer file creation", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(file_name) = LOWER('{{installer_name}}') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Look for the specific WatchGuard installer being written to disk by a browser process.", "expected_signal": "File creation events for the installer name on candidate hosts." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Detection of installer file creation", "reads": [ "device_hostname", "file_name", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(file_name) = LOWER('{{installer_name}}') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "File creation events for the installer name on candidate hosts.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "installer-execution-events", "type": "query", "label": "Installer process execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, process_file_company, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%' || LOWER('{{installer_name}}') OR LOWER(process_file_company) LIKE '%watchguard%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect the actual execution of the installer, using company name metadata to find renamed binaries.", "expected_signal": "Process launch events for binaries identified as belonging to WatchGuard." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Installer process execution", "reads": [ "device_hostname", "process_cmd_line", "process_file_company", "process_name", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, process_file_company, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%' || LOWER('{{installer_name}}') OR LOWER(process_file_company) LIKE '%watchguard%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Process launch events for binaries identified as belonging to WatchGuard.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "follow-on-triage", "type": "analytic", "label": "Correlate full phishing and execution chain", "config": { "cite": "required", "tools": [ "endpoint", "network", "web" ], "context": [ "early-stage-triage", "installer-file-events", "installer-execution-events" ], "objective": "Synthesize the entire chain from SEO redirection to legitimate installer execution, building on the victim identification in the early-stage read.", "description": "Correlate the early-stage interaction with the final delivery and execution to confirm successful credential theft.", "max_iterations": 4, "expected_signal": "High-confidence verdicts for hosts following the complete attack chain.", "success_criteria": "A timeline of events for each affected host confirming the harvesting modal was shown followed by installer delivery." }, "parents": [ { "id": "installer-file-events", "kind": "merge" }, { "id": "installer-execution-events", "kind": "merge" } ] }, { "id": "routing-decision", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the follow-on-triage verdict is malicious for at least one host, indicating successful navigation to the lure followed by installer delivery", "condition": "the follow-on-triage verdict is malicious for at least one host, indicating successful navigation to the lure followed by installer delivery", "blind_spot": "no-http-path-visibility", "confidence": "high", "description": "Route based on the synthesized chain verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "follow-on-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Contain the host and notify the identity team to reset credentials.", "instructions": "Isolate the host and notify the identity team to reset the VPN credentials for the affected user immediately.", "action_approval": "required" }, "parents": [ { "id": "routing-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Detailed Analyst Review", "config": { "assignee": "analyst", "description": "Verify telemetry for credential POSTing.", "instructions": "Review the HTTP telemetry specifically for POST requests to watchguard-ssl.online. Check for VPN logins from unusual geolocations for the affected user." }, "parents": [ { "id": "routing-decision", "branch": "default" }, { "id": "routing-decision", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document findings and update blocks.", "instructions": "Update domain and IP blocklists. Confirm MFA-backed password resets for all identified victims." }, "parents": [ { "id": "routing-decision", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }