{
  "Event": {
    "analysis": "1",
    "date": "2026-07-14",
    "extends_uuid": "",
    "info": "[Threat Intel] \u200b\u200bKratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk\u200b",
    "protected": false,
    "publish_timestamp": "1784560914",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784560914",
    "uuid": "514a8f57-fa91-4990-a0d3-a76140eb70e7",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#60f452",
        "local": false,
        "name": "misp-galaxy:producer=\"ANY.RUN\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d38fc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Acquire Infrastructure - T1583\"",
        "relationship_type": ""
      },
      {
        "colour": "#f146c3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Sharepoint - T1213.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#db2044",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1598.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#5c59c9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Accounts - T1586.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#82eae0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#b25e1b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Use Alternate Authentication Material - T1550\"",
        "relationship_type": ""
      },
      {
        "colour": "#aa1f95",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Staged - T1074\"",
        "relationship_type": ""
      },
      {
        "colour": "#b206a3",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Accounts - T1586\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#23cf0e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Email Collection - T1114.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0d02a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#5884a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#b8ab01",
        "local": false,
        "name": "misp-galaxy:target-information=\"United States\"",
        "relationship_type": ""
      },
      {
        "colour": "#66e036",
        "local": false,
        "name": "misp-galaxy:target-information=\"Austria\"",
        "relationship_type": ""
      },
      {
        "colour": "#a7b0e0",
        "local": false,
        "name": "misp-galaxy:target-information=\"Belgium\"",
        "relationship_type": ""
      },
      {
        "colour": "#15ccfd",
        "local": false,
        "name": "misp-galaxy:target-information=\"France\"",
        "relationship_type": ""
      },
      {
        "colour": "#5ed128",
        "local": false,
        "name": "misp-galaxy:target-information=\"Germany\"",
        "relationship_type": ""
      },
      {
        "colour": "#4cea11",
        "local": false,
        "name": "misp-galaxy:target-information=\"Italy\"",
        "relationship_type": ""
      },
      {
        "colour": "#c180fb",
        "local": false,
        "name": "misp-galaxy:target-information=\"Norway\"",
        "relationship_type": ""
      },
      {
        "colour": "#c70b8f",
        "local": false,
        "name": "misp-galaxy:target-information=\"Portugal\"",
        "relationship_type": ""
      },
      {
        "colour": "#c62adc",
        "local": false,
        "name": "misp-galaxy:target-information=\"Slovenia\"",
        "relationship_type": ""
      },
      {
        "colour": "#f439e5",
        "local": false,
        "name": "misp-galaxy:target-information=\"Spain\"",
        "relationship_type": ""
      },
      {
        "colour": "#63bd05",
        "local": false,
        "name": "misp-galaxy:target-information=\"Sweden\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#10003f",
        "local": false,
        "name": "rectifyq:sub-category=\"tool-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Stealc\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"WordPress\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"cloudflare\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784199614",
        "to_ids": false,
        "type": "link",
        "uuid": "9e99e8d7-7056-4208-a729-23be9b8342da",
        "value": "https://any.run/cybersecurity-blog/kratos-phaas-account-takeover/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784199614",
        "to_ids": false,
        "type": "text",
        "uuid": "4499119d-51fc-4998-b37a-f50f5f856a3d",
        "value": "Kratos is a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the United States, Europe, and other regions. The platform enables attackers to steal credentials through trusted platforms, anti-bot verification, and convincing login pages. Researchers traced three generations of the kit and uncovered 1,484 previously unattributed detonations. The operation targets organizations across more than 20 countries with particularly strong concentration in the US, Spain, and Southern Europe. Kratos includes an operator panel allowing deployment of phishing domains, configurable Telegram or email delivery, geographic restrictions, and multiple anti-bot systems. The kit has evolved through three page generations (V0, V1, V2) with different exfiltration code. Activity has been visible since January 2026, with the operator panel active since September 2025."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784199614",
        "to_ids": false,
        "type": "text",
        "uuid": "92dd46a8-33d9-4022-9b4c-7e74eb63d279",
        "value": "Name: \u200b\u200bKratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk\u200b\nAuthor: AlienVault\nAdversary: \nTags: [\"microsoft 365\", \"kratos\", \"united states\", \"europe\", \"spain\", \"phishing-as-a-service\", \"credential theft\", \"account takeover\"]\nTgtd countries: [\"United States of America\", \"Austria\", \"Belgium\", \"France\", \"Germany\", \"Italy\", \"Norway\", \"Portugal\", \"Slovenia\", \"Spain\", \"Sweden\"]\nMlwr families: []\nAttack_ids: [\"T1583\", \"T1213.002\", \"T1114\", \"T1566.002\", \"T1598.003\", \"T1586.002\", \"T1583.001\", \"T1550\", \"T1074\", \"T1586\", \"T1204\", \"T1566\", \"T1078\", \"T1114.002\", \"T1598\", \"T1213\", \"T1189\", \"T1071.001\", \"T1204.001\", \"T1078.004\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559811",
        "to_ids": true,
        "type": "domain",
        "uuid": "979f578c-4ec9-493b-8474-23da86741c29",
        "value": "buenne.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559832",
        "to_ids": true,
        "type": "domain",
        "uuid": "b9604299-6922-4ef8-badd-88064af92005",
        "value": "enerdizerandtron.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559853",
        "to_ids": true,
        "type": "domain",
        "uuid": "6fce33ce-af80-4424-8116-8d2c965fac6b",
        "value": "ihrsupportcenter.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559875",
        "to_ids": true,
        "type": "domain",
        "uuid": "eae02c7a-a696-4882-b7b7-cab6fc9cb9ea",
        "value": "rundwasser.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559896",
        "to_ids": true,
        "type": "domain",
        "uuid": "d820f6b4-1517-4f3b-98de-547b8f1f0e6f",
        "value": "sonnenbrillenspot.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559917",
        "to_ids": true,
        "type": "hostname",
        "uuid": "835111e3-db15-4b99-a633-682341ca24e1",
        "value": "dwbud.vilaribit.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559938",
        "to_ids": true,
        "type": "domain",
        "uuid": "45b96542-34c8-44c5-8ffd-03cc5c82c997",
        "value": "abal.my",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559960",
        "to_ids": true,
        "type": "domain",
        "uuid": "07709db3-a8b2-43d6-b6b5-6156432b69d3",
        "value": "starwellmedia.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784559981",
        "to_ids": true,
        "type": "domain",
        "uuid": "2030fd67-3545-4552-b69f-d58d090d3a22",
        "value": "aabiz.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560002",
        "to_ids": true,
        "type": "domain",
        "uuid": "9bd9ad54-6d40-4b82-b5a4-6706f92c64f6",
        "value": "aspireglobal.ltd",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560023",
        "to_ids": true,
        "type": "domain",
        "uuid": "8c515710-d08e-4da2-8aa5-cf6b9b5f6351",
        "value": "dufllot.sbs",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560045",
        "to_ids": true,
        "type": "domain",
        "uuid": "26ac741c-db4a-4068-a5f9-cb0d96eae0e1",
        "value": "espaciocf.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560066",
        "to_ids": true,
        "type": "domain",
        "uuid": "40b92d72-e8ce-4850-a6a9-13b76c04660a",
        "value": "ilersls.org",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560087",
        "to_ids": true,
        "type": "domain",
        "uuid": "f287ffb9-4a8d-4afe-84e0-65e8bfcde8cf",
        "value": "aaalen.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560108",
        "to_ids": true,
        "type": "domain",
        "uuid": "b6638f17-ed05-4f2a-ba3d-495b3f20a53a",
        "value": "smartcontrolengineer.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560130",
        "to_ids": true,
        "type": "domain",
        "uuid": "d7263fc2-5fee-48ab-bf06-d41e1f3765fb",
        "value": "trisrnareprjdocz.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560151",
        "to_ids": true,
        "type": "domain",
        "uuid": "c64d6123-689c-4874-b725-5075a7c05312",
        "value": "razen.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560172",
        "to_ids": true,
        "type": "domain",
        "uuid": "270d6dc0-ebbf-4454-8dc5-182dc7cab3b4",
        "value": "theoceanac.online",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560193",
        "to_ids": true,
        "type": "domain",
        "uuid": "adeaaa43-cde3-4031-b571-3a24a1f085ea",
        "value": "jumpast.es",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560214",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "f6ff50a2-cd10-4da0-a4e5-170b0316742b",
        "value": "41.128.0.142",
        "Tag": [
          {
            "colour": "#f5dab5",
            "local": false,
            "name": "asn:asn=\"24863\"",
            "relationship_type": ""
          },
          {
            "colour": "#c8788c",
            "local": false,
            "name": "asn:as-owner=\"LINKdotNET-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#ce8b7f",
            "local": false,
            "name": "asn:as-country=\"EG\"",
            "relationship_type": ""
          },
          {
            "colour": "#ca6ae7",
            "local": false,
            "name": "misp-galaxy:country=\"egypt\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560236",
        "to_ids": true,
        "type": "domain",
        "uuid": "761d88fc-e0c1-4ace-9e56-1b09dca3da45",
        "value": "crm-technik.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560257",
        "to_ids": true,
        "type": "domain",
        "uuid": "698e08df-155a-406f-8864-dc7bba4331a3",
        "value": "klenpare.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560278",
        "to_ids": true,
        "type": "domain",
        "uuid": "460d1c4e-4777-4ac8-acbd-1e26fd7a462a",
        "value": "uvarnix.cfd",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784560299",
        "to_ids": true,
        "type": "domain",
        "uuid": "1512c7ad-564c-48a4-ad09-25dacf56450c",
        "value": "xavon.sbs",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}