{
  "Event": {
    "analysis": "1",
    "date": "2026-07-21",
    "extends_uuid": "",
    "info": "[Threat Intel] Inside a Global Procurement-Themed AiTM Phishing Campaign",
    "protected": false,
    "publish_timestamp": "1785577591",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785577591",
    "uuid": "5f8b22b1-d7e1-4b53-b3ce-105a73b23edb",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Infoblox\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Storm-1167\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"FlowerStorm\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Evilginx\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"cloudflare\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784718016",
        "to_ids": false,
        "type": "link",
        "uuid": "5bfc7ddc-b87c-4e69-8cfc-7fe35ffc5ebc",
        "value": "https://www.infoblox.com/blog/threat-intelligence/the-procurement-trap-inside-an-aitm-campaign-targeting-global-institutions/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784718016",
        "to_ids": false,
        "type": "text",
        "uuid": "a2ccf7e5-5834-446d-9ecd-322847e079d0",
        "value": "A sophisticated adversary-in-the-middle phishing campaign is targeting universities, enterprises, and multinational institutions including EU and UN agencies. Active since May 2026, the operation leverages compromised organizational email accounts to distribute procurement-themed lures that mimic requests for information, bid invitations, and project documentation. Victims are redirected through fake document portals, CAPTCHA verification stages, and cloned authentication pages impersonating Microsoft, OpenGov, and financial institutions. The attacker rotates between multiple AiTM phishing kits including EvilProxy, FlowerStorm, and Kali365 to intercept MFA-protected sessions in real time, capturing session tokens and cookies to establish authenticated access. Rather than using newly registered domains, the actor compromises aged domains that have been dormant for years, injecting PHP files to host phishing infrastructure and evade detection through domain reputation systems."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784718016",
        "to_ids": false,
        "type": "text",
        "uuid": "3aef0f77-9b38-480d-82cb-0bf9441947bd",
        "value": "Name: Inside a Global Procurement-Themed AiTM Phishing Campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"aitm phishing\", \"flowerstorm\", \"procurement lures\", \"domain compromise\", \"session hijacking\", \"mfa bypass\", \"evilproxy\", \"credential theft\", \"kali365\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: [\"Education\", \"Government\", \"Finance\"]"
      },
      {
        "category": "Network activity",
        "comment": "Domains likely compromised and hosting fake document download pages",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119326",
        "to_ids": true,
        "type": "domain",
        "uuid": "9ad0be26-0e0a-419b-ac29-41f62073f289",
        "value": "sohantraders.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Domains likely compromised and hosting fake document download pages",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119347",
        "to_ids": true,
        "type": "domain",
        "uuid": "426d3839-3715-4d06-984b-a70896a0b618",
        "value": "satoriestate.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119368",
        "to_ids": true,
        "type": "domain",
        "uuid": "cdd28242-2a15-4103-a38d-2e3ff459c4ac",
        "value": "company.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Kali365 PhaaS Domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119390",
        "to_ids": true,
        "type": "domain",
        "uuid": "f0763a85-3441-427c-b3e4-96a6dbd4a253",
        "value": "duemineral.uk",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "EvilProxy PhaaS Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119411",
        "to_ids": true,
        "type": "domain",
        "uuid": "3bfb1b11-01a0-4fd9-9f84-b1ccfb93c99f",
        "value": "assessmentevaluationreport.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Domains likely compromised and hosting fake document download pages",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119433",
        "to_ids": true,
        "type": "domain",
        "uuid": "1236f030-ec1f-49f3-8aa0-39ff8fc880b5",
        "value": "barifurniture.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "FlowerStorm/Storm-1167 Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119454",
        "to_ids": true,
        "type": "domain",
        "uuid": "21864db3-1bb0-436e-8541-a202f149e9c0",
        "value": "consistenthostinghub.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "EvilProxy PhaaS Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119475",
        "to_ids": true,
        "type": "domain",
        "uuid": "31b4ea22-420e-4060-b04c-cfa14ae00789",
        "value": "corporatetermscompliance.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "FlowerStorm/Storm-1167 Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119496",
        "to_ids": true,
        "type": "domain",
        "uuid": "9b748b86-996e-433c-8352-722e322bdf04",
        "value": "designenhancessatisfaction.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "EvilProxy PhaaS Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119517",
        "to_ids": true,
        "type": "domain",
        "uuid": "2597205e-902b-4dd4-8830-3c4146c6a619",
        "value": "employeehandbookcompliance.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "EvilProxy PhaaS Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119538",
        "to_ids": true,
        "type": "domain",
        "uuid": "7e2fb88f-ff49-441e-a1e0-ae7d218ef502",
        "value": "esignidentification.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "FlowerStorm/Storm-1167 Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119559",
        "to_ids": true,
        "type": "domain",
        "uuid": "98c3280f-1917-4fc1-96a0-a352797c5b25",
        "value": "evergreenhostingoptions.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "FlowerStorm/Storm-1167 Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119580",
        "to_ids": true,
        "type": "domain",
        "uuid": "0587e243-8b33-42b4-a52d-640c638c7caa",
        "value": "innovativegrowthstrategy.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "EvilProxy PhaaS Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119602",
        "to_ids": true,
        "type": "domain",
        "uuid": "3f15fc24-7b7e-4206-a445-c3cd4ece05c4",
        "value": "q1evaluationperformance.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "FlowerStorm/Storm-1167 Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119624",
        "to_ids": true,
        "type": "domain",
        "uuid": "0946b4ec-a2ac-40f9-8b0f-277b1941cbad",
        "value": "reliablecontinuitysolutions.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "FlowerStorm/Storm-1167 Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119645",
        "to_ids": true,
        "type": "domain",
        "uuid": "ea4acad6-1087-4cbf-8758-3fa80dad6775",
        "value": "solidhostingservices.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "FlowerStorm/Storm-1167 Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119666",
        "to_ids": true,
        "type": "domain",
        "uuid": "01d4a347-7774-4d74-b1cb-ed5e3964a96f",
        "value": "sustainablegrowthlaunch.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Domains likely compromised and hosting fake document download pages",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119687",
        "to_ids": true,
        "type": "domain",
        "uuid": "f1061998-6cfd-4677-b071-0ff57b88225a",
        "value": "testserveren.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "FlowerStorm/Storm-1167 Domains",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119708",
        "to_ids": true,
        "type": "domain",
        "uuid": "e53bcacd-9293-40af-9db4-9e56ea3e1f8e",
        "value": "usersatisfactionlab.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Domains likely compromised and hosting fake document download pages",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119729",
        "to_ids": true,
        "type": "domain",
        "uuid": "36b99b29-bb09-48f3-ab3c-b242dca0693a",
        "value": "vresortsliving.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785119750",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5e55a891-2a4e-4858-8c9c-bbca6aa5b24d",
        "value": "ajgroupuae.usersatisfactionlab.de",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}