Kasablanka

Executive Summary

Kasablanka is a cyber-criminal group active between September and December 2022, primarily targeting entities in Russia through phishing campaigns. The group utilizes malicious payloads delivered via phishing emails containing socially engineered LNK files, ZIP packages, and executables attached to virtual disk image files.

Goals & Targeting

Kasablanka appears to have targeted Russian entities between September and December 2022, suggesting a focus on compromising specific sectors or industries within that country. The group's targeting profile may be linked to financial motivations or efforts to disrupt critical infrastructure. Their victims include organizations or individuals in Russia who were exposed through phishing campaigns.

Kasablanka is a cyber-criminal organization that has been observed targeting Russian entities between September and December 2022. The group's primary method of attack involves the distribution of malicious payloads through phishing emails. These emails include socially engineered LNK files, ZIP packages, and executables attached to virtual disk image files. The group's activities demonstrate a focus on compromising specific targets within Russia, likely for financial gain or disruptive purposes. Despite their targeting of Russian entities, Kasablanka's broader strategic goals and operational capabilities remain unclear from the available data.

Key Capabilities

• Phishing email distribution
• Social engineering tactics
• Payload delivery via malicious file attachments (LNK, ZIP, executables)
• Use of virtual disk image files for payload delivery

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Kasablanka's campaigns were active between September and December 2022, with a primary focus on Russian targets. The group's operational tempo appears to be campaign-based, utilizing phishing as the main attack vector. Notable past operations include the distribution of malicious payloads via phishing emails targeting individuals and organizations in Russia.

IOC Patterns

• Phishing emails with malicious LNK files
• ZIP packages containing malicious executables
• Virtual disk image files (VHD/VCD) used as payload delivery vectors

Recommended Actions

• Implement robust email filtering and threat detection solutions to detect phishing attempts.
• Train employees to recognize and report suspicious emails with unsolicited attachments or links.
• Monitor network traffic for indicators of malicious file downloads and unauthorized process execution.
• Use endpoint detection and response (EDR) tools to identify and block known malicious files.

Suggested Tags