kirapayload

Executive Summary

Kirapayload is a financially motivated threat actor offering an Adversary‑in‑the‑Middle (AiTM) phishing-as-a-service platform, ‘Cloaked.gg’, that intercepts authentication tokens and 2FA codes in real time through a reverse‑proxy. It targets high‑profile sectors across the US, Canada, Australia, Brazil, and Russia, leveraging cloud services for infrastructure, stealth, and exfiltration. The actor combines credential theft with spoofed traffic and AI‑generated decoy pages to split view victims while evading automated detection.

Goals & Targeting

The actor’s overarching objective is monetary gain through credential theft and data exfiltration from high‑value sectors such as finance, defense, healthcare, and critical infrastructure. By offering a low‐barrier marketplace for AiTM services, Kirapayload expands its operational reach to less technically sophisticated adversaries, thereby broadening the attack surface. Targeting organizations that rely heavily on cloud services and MFA, the actor seeks to bypass conventional defenses while extracting valuable data or delivering ransomware payloads. Its targeting profile includes government agencies and public sector entities in the US, Canada, Australia, Brazil, and Russia, sectors with high reputational risk and lucrative data holdings. Kirapayload also focuses on enterprises that use Microsoft 365, Google Workspace, or other SaaS platforms where credential lateral movement is feasible.

Key Capabilities

• UAC bypass for privilege escalation
• Use of compromised email and cloud accounts for initial access
• Leverage third‑party web services as command and control
• Domain account creation via net user /add /domain
• Valid credentials to Exchange, Office 365, or Google Workspace
• Automated email keyword search with MailSniper
• Endpoint denial‑of‑service attacks
• Exploitation of software vulnerabilities for crash/lateral movement
• Email phishing abuse
• Cloud provider accounts acquisition
• Polymorphic/mutating code for evasion
• Command obfuscation and encryption

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Kirapayload exhibits a rapid operational tempo, often spinning up new phishing campaigns within days of registering cloud infrastructure. Its infrastructure appears modular; the actor creates multiple tenant domains in public clouds and then flips traffic through its Cloaked.gg layer to avoid detection. Victims span high‑profile enterprises with globally distributed assets – typical for organizations heavily reliant on cloud services. Past operations have surfaced a pattern where compromised accounts are leveraged for both credential harvesting and lateral movement, followed by a quick transition to ransomware or extortion narratives. Continuous use of AI‑generated decoys suggests an evolving response to automated analysis platforms.

IOC Patterns

• Domain account creation via net user command usage
• Credential-based access to Exchange/Office 365/Google Workspace mailboxes
• Endpoint resource exhaustion for DoS attacks
• Use of public cloud storage (S3, OneDrive, Dropbox) for exfiltration
• Spoofed HTTP User‑Agent strings in traffic
• Malicious replacement of service binaries

Recommended Actions

• Deploy real‑time monitoring of net user /add and other domain account creation events to detect lateral expansion.
• Enforce MFA with hardened bypass detection mechanisms (e.g., UAC bypass alerts).
• Implement network segmentation and rate limiting for critical services to mitigate DoS impact.
• Conduct daily credential validation checks on enterprise email and cloud accounts for abnormal access patterns.
• Apply strict file permission controls on Windows service binaries and directories to prevent tampering.
• Use behavioral IDS/UEBA solutions to detect polymorphic/mutating code activity.
• Maintain up‑to‑date signatures for known phishing templates and AiTM reverse‐proxy traffic.
• Implement application whitelisting and enforce the principle of least privilege across all endpoints.

Suggested Tags