{"id":95070,"date":"2021-07-29T08:00:11","date_gmt":"2021-07-29T15:00:11","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=95070"},"modified":"2023-09-11T15:47:41","modified_gmt":"2023-09-11T22:47:41","slug":"bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/07\/29\/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware\/","title":{"rendered":"BazaCall: Phony call centers lead to exfiltration and ransomware"},"content":{"rendered":"

Our continued investigation into BazaCall campaigns, those that use fraudulent call centers that trick unsuspecting users into downloading the BazaLoader malware, shows that this threat is more dangerous than what\u2019s been discussed publicly in other security blogs and covered by the media. Apart from having backdoor capabilities, the BazaLoader payload from these campaigns also gives a remote attacker hands-on-keyboard control on an affected user\u2019s device, which allows for a fast network compromise. In our observation, attacks emanating from the BazaCall threat could move quickly within a network, conduct extensive data exfiltration and credential theft, and distribute ransomware within 48 hours of the initial compromise.<\/p>\n\n\n\n
Additional resources<\/em><\/strong><\/p>\n

Protect your organization against ransomware: aka.ms\/ransomware<\/a><\/em><\/p>\n

Learn how attackers operate: Human-operated ransomware attacks: A preventable disaster<\/a><\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

BazaCall campaigns forgo malicious links or attachments in email messages in favor of phone numbers that recipients are misled into calling. It\u2019s a technique reminiscent of vishing and tech support scams where potential victims are being cold-called by the attacker, except in BazaCall\u2019s case, targeted users must<\/em> dial the number. And when they do, the users are connected with actual<\/em> humans on the other end of the line, who then provide step-by-step instructions for installing malware into their devices. Thus, BazaCall campaigns require direct phone communication with a human and social engineering tactics to succeed. Moreover, the lack of obvious malicious elements in the delivery methods could render typical ways of detecting spam and phishing emails ineffective.<\/p>\n

\"Diagram<\/p>\n

Figure 1. The flow of a typical BazaCall attack, from the spam email to social engineering to the payload being downloaded and hands-on-keyboard attacks<\/em><\/p>\n

The use of another human element in BazaCall\u2019s attack chain through the abovementioned hands-on-keyboard control further makes this threat more dangerous and more evasive than traditional, automated malware attacks. BazaCall campaigns highlight the importance of cross-domain optics and the ability to correlate events in building a comprehensive defense against complex threats.<\/p>\n

Microsoft 365 Defender<\/a> orchestrates protection across domains to deliver coordinated defense. In the case of BazaCall, Microsoft Defender for Endpoint<\/a> detects malware and attacker behavior resulting from the campaign, and these signals inform Microsoft Defender for Office 365<\/a> protections against related emails, even if these emails don\u2019t have the typical malicious artifacts. Microsoft threat analysts who constantly monitor BazaCall campaigns enrich the intelligence on this threat and enhance our ability to protect customers.<\/p>\n

In this blog post, we discuss how a recent BazaCall campaign attempts to compromise systems and networks through the mentioned human elements and how Microsoft defends against it.<\/p>\n

Out with the links and attachments, in with the customer service phone numbers<\/h2>\n

BazaCall campaigns begin with an email that uses various social engineering lures to trick target recipients into calling a phone number. For example, the email informs users about a supposed expiring trial subscription and that their credit card will soon be automatically charged for the subscription\u2019s premium version. Each wave of emails in the campaign uses a different \u201ctheme\u201d of subscription that is supposed to be expiring, such as a photo editing service or a cooking and recipes website membership. In a more recent campaign, the email does away with the subscription trial angle and instead poses as a confirmation receipt for a purchased software license.<\/p>\n

Unlike typical spam and phishing emails, BazaCall\u2019s do not have a link or attachment in its message body that users must click or open. Instead, it instructs users to call a phone number in case they have questions or concerns. This lack of typical malicious elements\u2014links or attachments\u2014adds a level of difficulty in detecting and hunting for these emails. In addition, the messaging of the email\u2019s content might also add an air of legitimacy if the user has been narrowly trained to avoid typical phishing and malware emails but not taught to be wary of social engineering techniques.<\/p>\n

\"Screenshot<\/p>\n

Figure 2. A typical BazaCall email, claiming that the user’s trial for a photo editing service will soon expire, and that they will be automatically charged. A fake customer service number is provided to help cancel the subscription.<\/em><\/p>\n

Each BazaCall email is sent from a different sender, typically using free email services and likely-compromised email addresses. The lures within the email use fake business names that are similar to the names of real businesses. A recipient who then searches the business name online to check the email\u2019s legitimacy may be led to believe that such a company exists and that the message they received has merit.<\/p>\n

Some sample subject lines are listed below. They each have a unique \u201caccount number\u201d created by the attackers to identify the recipients:<\/p>\n