Detecting and Mitigating Staged Link Targets (T1608.005)

Link Target (T1608.005) is a Resource Development sub-technique of Stage Capabilities, with PRE as its platform. Before a spearphishing email can work, the adversary needs a page for the link to open. This technique covers building that page.

The setup is invisible to you. The click is not.

How attackers use it

MITRE describes resources referenced by a link that an adversary can use during targeting. The link is usually used for spearphishing, with social engineering text to coax a user to click or paste a URL. The link target is typically an HTML page, possibly with client-side JavaScript that decides what content to serve.

Two common targets are named:

• Cloned login pages. Adversaries may clone legitimate sites, including login pages of web services or an organization's own login page, to harvest credentials.
• Malware downloads. The link can point to malware for the user to download and run, tying this to Upload Malware (T1608.001).

Adversaries may also buy domains similar to legitimate ones, using homoglyphs, typosquatting or a different top-level domain, to help a malicious link look right.

Documented examples from the page include: Silent Librarian cloned victim organization login pages and used URL shorteners for the staged sites; NIMBUS MANTICORE registered domains pointing to a typo-squatted domain and shared credentials with a link to spoofed login pages; FIN7 and LuminousMoth used links to files hosted on Dropbox; and in the Salesforce Data Exfiltration campaign, threat actors set up an Okta phishing panel that victims were tricked into visiting during social engineering calls.

How to detect it

MITRE says internet scanning may uncover staged web content if patterns were previously identified, though most of this happens out of view. Detection effort belongs in related phases: Spearphishing Link and Malicious Link.

• Check mail and chat gateways for links to newly registered or lookalike domains.
• Compare the domain of any login page against your identity provider's real domains. Report mismatches.
• Watch for users entering credentials on pages outside your sign-in domains, if your tooling supports that signal.
• Take note of URL shorteners in inbound mail, since the page lists them as a feature of staged sites.

How to reduce the risk

MITRE says this cannot easily be mitigated with preventive controls. The click is where you win:

1. Use phishing-resistant sign-in methods, so a cloned page cannot reuse what it collects.
2. Register obvious lookalike domains of your own where practical.
3. Train people to check the address bar and to treat urgent calls and links together as a warning sign, as in the help desk style calls described on the page.
4. Route login traffic through a single, well known address that people recognize.

Check your own environment

• Write down every domain that legitimately hosts your login pages. Make it easy for staff to find.
• Search your mail logs for links to domains that resemble yours.
• Confirm your phishing report button reaches someone who acts on it.
• Test whether your sign-in method would still stop a stolen password.

Quick check

Sources

• MITRE ATT&CK T1608.005 Stage Capabilities: Link Target