www.group-ib.com
Open in
urlscan Pro
3.72.181.255
Public Scan
URL:
https://www.group-ib.com/blog/0ktapus/
Submission: On October 09 via api from US — Scanned from DE
Submission: On October 09 via api from US — Scanned from DE
Form analysis 5 forms found in the DOM
POST https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/044e7558-8073-478a-ad3c-5807dd76840f
<form id="hsForm_044e7558-8073-478a-ad3c-5807dd76840f" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/044e7558-8073-478a-ad3c-5807dd76840f"
class="hs-form-private hsForm_044e7558-8073-478a-ad3c-5807dd76840f hs-form-044e7558-8073-478a-ad3c-5807dd76840f hs-form-044e7558-8073-478a-ad3c-5807dd76840f_c518b973-4b7f-49ba-9172-ae2e1e1cc084 hs-form stacked"
target="target_iframe_044e7558-8073-478a-ad3c-5807dd76840f" data-instance-id="c518b973-4b7f-49ba-9172-ae2e1e1cc084" data-form-id="044e7558-8073-478a-ad3c-5807dd76840f" data-portal-id="25755956" data-hs-cf-bound="true"
data-nb-form="bec50fad-48cf-4e31-bde9-db95bf65bbf6">
<div class="hs_firstname hs-firstname hs-fieldtype-text field hs-form-field"><label id="label-firstname-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your "
for="firstname-044e7558-8073-478a-ad3c-5807dd76840f"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="firstname-044e7558-8073-478a-ad3c-5807dd76840f" name="firstname" required="" placeholder="First name*" type="text" class="hs-input" inputmode="text" autocomplete="given-name" value=""></div>
</div>
<div class="hs_lastname hs-lastname hs-fieldtype-text field hs-form-field"><label id="label-lastname-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your " for="lastname-044e7558-8073-478a-ad3c-5807dd76840f"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="lastname-044e7558-8073-478a-ad3c-5807dd76840f" name="lastname" required="" placeholder="Last name*" type="text" class="hs-input" inputmode="text" autocomplete="family-name" value=""></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your " for="email-044e7558-8073-478a-ad3c-5807dd76840f"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-044e7558-8073-478a-ad3c-5807dd76840f" name="email" required="" placeholder="Email*" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""
data-nb-id="bec50fad-48cf-4e31-bde9-db95bf65bbf6"></div>
</div>
<div class="hs_phone hs-phone hs-fieldtype-phonenumber field hs-form-field"><label id="label-phone-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your " for="phone-044e7558-8073-478a-ad3c-5807dd76840f"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="phone-044e7558-8073-478a-ad3c-5807dd76840f" name="phone" placeholder="Phone number" type="tel" class="hs-input" inputmode="tel" autocomplete="tel" value=""></div>
</div>
<div class="hs_comment hs-comment hs-fieldtype-textarea field hs-form-field"><label id="label-comment-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your " for="comment-044e7558-8073-478a-ad3c-5807dd76840f"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><textarea id="comment-044e7558-8073-478a-ad3c-5807dd76840f" class="hs-input hs-fieldtype-textarea" name="comment" required="" placeholder="Incident description*"></textarea></div>
</div>
<div class="hs_latest_form_submitted hs-latest_form_submitted hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-latest_form_submitted-044e7558-8073-478a-ad3c-5807dd76840f" class=""
placeholder="Enter your Latest Form Submitted" for="latest_form_submitted-044e7558-8073-478a-ad3c-5807dd76840f"><span>Latest Form Submitted</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="latest_form_submitted" class="hs-input" type="hidden" value="COM-System-Report an incident"></div>
</div>
<div class="hs_utm_campaign hs-utm_campaign hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_campaign-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your utm_campaign"
for="utm_campaign-044e7558-8073-478a-ad3c-5807dd76840f"><span>utm_campaign</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_campaign" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_content hs-utm_content hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_content-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your utm_content"
for="utm_content-044e7558-8073-478a-ad3c-5807dd76840f"><span>utm_content</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_content" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_medium hs-utm_medium hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_medium-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your utm_medium"
for="utm_medium-044e7558-8073-478a-ad3c-5807dd76840f"><span>utm_medium</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_medium" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_source hs-utm_source hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_source-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your utm_source"
for="utm_source-044e7558-8073-478a-ad3c-5807dd76840f"><span>utm_source</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_source" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_term__c hs-utm_term__c hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_term__c-044e7558-8073-478a-ad3c-5807dd76840f" class="" placeholder="Enter your utm_term"
for="utm_term__c-044e7558-8073-478a-ad3c-5807dd76840f"><span>utm_term</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_term__c" class="hs-input" type="hidden" value=""></div>
</div>
<div class="legal-consent-container">
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_136902391 hs-LEGAL_CONSENT.subscription_type_136902391 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list" required="">
<li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_136902391-044e7558-8073-478a-ad3c-5807dd76840f" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_136902391-044e7558-8073-478a-ad3c-5807dd76840f" class="hs-input" type="checkbox" name="LEGAL_CONSENT.subscription_type_136902391" value="true"><span>
<p>I understand and agree that my personal data will be collected and processed according to the <a href="https://www.group-ib.com/policy.html" target="_blank" rel="noopener">Privacy and Cookies Policy</a> and
unconditionally agree and accept the <a href="https://www.group-ib.com/term-of-use.html" target="_blank" rel="noopener">Terms of Use</a></p><span class="hs-form-required">*</span>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Send report"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1696881499211","formDefinitionUpdatedAt":"1663062813967","lang":"en","legalConsentOptions":"{\"communicationConsentCheckboxes\":[{\"communicationTypeId\":136902391,\"label\":\"<p>I understand and &nbsp;agree that my personal data will be collected and processed according to the <a href=\\\"https://www.group-ib.com/policy.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Privacy and Cookies Policy</a> and unconditionally agree and accept the <a href=\\\"https://www.group-ib.com/term-of-use.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Terms of Use</a></p>\",\"required\":true}],\"legitimateInterestLegalBasis\":\"LEGITIMATE_INTEREST_PQL\",\"processingConsentType\":\"IMPLICIT\",\"processingConsentCheckboxLabel\":\"<p>I agree to allow Group-IB to store and process my personal data.</p>\",\"isLegitimateInterest\":false}","embedType":"REGULAR","clonedFromForm":"fec8ebd7-2fbb-428e-adb1-2ed1cfb1849c","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36","pageTitle":"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog","pageUrl":"https://www.group-ib.com/blog/0ktapus/","referrer":"https://www.group-ib.com/blog/0ktapus/","isHubSpotCmsGeneratedPage":false,"hutk":"31d70e7cb3dd29a6d1eb5a8b6db1fef2","__hsfp":3335903367,"__hssc":"84897990.1.1696881500725","__hstc":"84897990.31d70e7cb3dd29a6d1eb5a8b6db1fef2.1696881500725.1696881500725.1696881500725.1","formTarget":"#hbspt-form-c518b973-4b7f-49ba-9172-ae2e1e1cc084","boolCheckBoxFields":"LEGAL_CONSENT.subscription_type_136902391","locale":"en","timestamp":1696881500748,"originalEmbedContext":{"portalId":"25755956","formId":"044e7558-8073-478a-ad3c-5807dd76840f","region":"eu1","target":"#hbspt-form-c518b973-4b7f-49ba-9172-ae2e1e1cc084","isBuilder":false,"isTestPage":false,"isPreview":false,"isMobileResponsive":true},"correlationId":"c518b973-4b7f-49ba-9172-ae2e1e1cc084","renderedFieldsIds":["firstname","lastname","email","phone","comment","latest_form_submitted","utm_campaign","utm_content","utm_medium","utm_source","utm_term__c","LEGAL_CONSENT.subscription_type_136902391"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.3812","sourceName":"forms-embed","sourceVersion":"1.3812","sourceVersionMajor":"1","sourceVersionMinor":"3812","_debug_allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1696881499373,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog\",\"pageUrl\":\"https://www.group-ib.com/blog/0ktapus/\",\"referrer\":\"https://www.group-ib.com/blog/0ktapus/\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1696881499376,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""},{"clientTimestamp":1696881500742,"level":"INFO","message":"Retrieved analytics values from API response which may be overriden by the embed context: {\"hutk\":\"31d70e7cb3dd29a6d1eb5a8b6db1fef2\"}"}]}"><iframe
name="target_iframe_044e7558-8073-478a-ad3c-5807dd76840f" style="display: none;"></iframe>
</form>POST https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345
<form id="hsForm_4dbceae1-75ae-423a-9c12-dee8f1ca3345" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/4dbceae1-75ae-423a-9c12-dee8f1ca3345"
class="hs-form-private hsForm_4dbceae1-75ae-423a-9c12-dee8f1ca3345 hs-form-4dbceae1-75ae-423a-9c12-dee8f1ca3345 hs-form-4dbceae1-75ae-423a-9c12-dee8f1ca3345_62cc391b-337e-483b-9a54-d5d3cab8b6f3 hs-form stacked"
target="target_iframe_4dbceae1-75ae-423a-9c12-dee8f1ca3345" data-instance-id="62cc391b-337e-483b-9a54-d5d3cab8b6f3" data-form-id="4dbceae1-75ae-423a-9c12-dee8f1ca3345" data-portal-id="25755956" data-hs-cf-bound="true"
data-nb-form="27d61ee2-5ebd-45b6-8bb1-646790df6be7">
<div class="hs_product_service hs-product_service hs-fieldtype-select field hs-form-field"><label id="label-product_service-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your "
for="product_service-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="product_service-4dbceae1-75ae-423a-9c12-dee8f1ca3345" required="" class="hs-input is-placeholder" name="product_service">
<option disabled="" value="">Please choose a product/service you are interested in*</option>
<option value="Attack Surface Management">Attack Surface Management</option>
<option value="Business Email Protection">Business Email Protection</option>
<option value="Digital Risk Protection">Digital Risk Protection</option>
<option value="Education">Education</option>
<option value="Fraud Protection">Fraud Protection</option>
<option value="Incident Response">Incident Response</option>
<option value="Investigations">Investigations</option>
<option value="Managed XDR">Managed XDR</option>
<option value="Security Audit">Security Audit</option>
<option value="Threat Intelligence">Threat Intelligence</option>
</select></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your " for="email-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-4dbceae1-75ae-423a-9c12-dee8f1ca3345" name="email" required="" placeholder="Business Email*" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""
data-nb-id="27d61ee2-5ebd-45b6-8bb1-646790df6be7"></div>
</div>
<div class="hs_firstname hs-firstname hs-fieldtype-text field hs-form-field"><label id="label-firstname-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your "
for="firstname-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="firstname-4dbceae1-75ae-423a-9c12-dee8f1ca3345" name="firstname" required="" placeholder="First name*" type="text" class="hs-input" inputmode="text" autocomplete="given-name" value=""></div>
</div>
<div class="hs_lastname hs-lastname hs-fieldtype-text field hs-form-field"><label id="label-lastname-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your " for="lastname-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="lastname-4dbceae1-75ae-423a-9c12-dee8f1ca3345" name="lastname" required="" placeholder="Last name*" type="text" class="hs-input" inputmode="text" autocomplete="family-name" value=""></div>
</div>
<div class="hs_company hs-company hs-fieldtype-text field hs-form-field"><label id="label-company-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your " for="company-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="company-4dbceae1-75ae-423a-9c12-dee8f1ca3345" name="company" required="" placeholder="Company*" type="text" class="hs-input" inputmode="text" autocomplete="organization" value=""></div>
</div>
<div class="hs_position hs-position hs-fieldtype-select field hs-form-field"><label id="label-position-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your "
for="position-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="position-4dbceae1-75ae-423a-9c12-dee8f1ca3345" required="" class="hs-input is-placeholder" name="position">
<option disabled="" value="">Job Title*</option>
<option value="CEO">CEO</option>
<option value="Fraud - Director/Analyst">Anti-Fraud Team</option>
<option value="Information Security - CISO/VP">Information Security - CISO/VP</option>
<option value="Information Security - Director/Head">Information Security - Director/Head</option>
<option value="Information Security - Team Lead/Manager">Information Security - Team Lead/Manager</option>
<option value="Information Security - Analyst/Engineer/Specialist/Consultant">Information Security - Analyst/Engineer/Specialist/Consultant</option>
<option value="Information Security - Other">Information Security - Other</option>
<option value="Threat Intelligence - Devision lead/Director/Head">Threat Intelligence - Devision lead/Director/Head</option>
<option value="Threat Intelligence - Analyst/Specialist/Researcher/Manager/Engineer">Threat Intelligence - Analyst/Specialist/Researcher/Manager/Engineer</option>
<option value="IT - CTO/CIO/VP">IT - CTO/CIO/VP</option>
<option value="IT - Director/Head">IT - Director/Head</option>
<option value="IT - Team Lead/Manager">IT - Team Lead/Manager</option>
<option value="IT - Analyst/Engineer/Specialist/Consultant">IT - Analyst/Engineer/Specialist/Consultant</option>
<option value="IT - Other">IT - Other</option>
<option value="Marketing/Media - CMO/Editor-in-Chief">Marketing/Media - CMO/Editor-in-Chief</option>
<option value="Marketing/Media - Director/Head/Senior Editor">Marketing/Media - Director/Head/Senior Editor</option>
<option value="Marketing/Media - Manager/Specialist/Reporter">Marketing/Media - Manager/Specialist/Reporter</option>
<option value="Marketing/Media - Other">Marketing/Media - Other</option>
<option value="Sales/Business Development - VP">Sales/Business Development - VP</option>
<option value="Sales/Business Development - Director/Head">Sales/Business Development - Director/Head</option>
<option value="Sales/Business Development - Manager">Sales/Business Development - Manager</option>
<option value="Sales/Business Development - Other">Sales/Business Development - Other</option>
<option value="HR">HR Team</option>
<option value="Legal">Legal Team</option>
<option value="Operations">Operations Team</option>
<option value="Finance">Finance Team</option>
<option value="Education">Education Team</option>
</select></div>
</div>
<div class="hs_phone hs-phone hs-fieldtype-phonenumber field hs-form-field"><label id="label-phone-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your " for="phone-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="phone-4dbceae1-75ae-423a-9c12-dee8f1ca3345" name="phone" required="" placeholder="Phone number*" type="tel" class="hs-input" inputmode="tel" autocomplete="tel" value=""></div>
</div>
<div class="hs-dependent-field">
<div class="hs_country_list hs-country_list hs-fieldtype-select field hs-form-field"><label id="label-country_list-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your "
for="country_list-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="country_list-4dbceae1-75ae-423a-9c12-dee8f1ca3345" required="" class="hs-input is-placeholder" name="country_list">
<option disabled="" value="">Country*</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="American Samoa">American Samoa</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Anguilla">Anguilla</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Aruba">Aruba</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermudas">Bermudas</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia">Bolivia</option>
<option value="Bonaire">Bonaire</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Bouvet Island">Bouvet Island</option>
<option value="Brazil">Brazil</option>
<option value="British Virgin Islands">British Virgin Islands</option>
<option value="Brunei">Brunei</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Christmas Island">Christmas Island</option>
<option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo (Brazzaville)">Congo (Brazzaville)</option>
<option value="Congo, Democratic Republic of the">Congo, Democratic Republic of the</option>
<option value="Cook Islands">Cook Islands</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Cote d'Ivoire (Ivory Coast)">Cote d'Ivoire (Ivory Coast)</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Curacao">Curacao</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="East Timor">East Timor</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Faroe Islands">Faroe Islands</option>
<option value="Federated States of Micronesia">Federated States of Micronesia</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Guiana">French Guiana</option>
<option value="French Polynesia">French Polynesia</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Gibraltar">Gibraltar</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guadeloupe">Guadeloupe</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guernsey and Alderney">Guernsey and Alderney</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Holy See (Vatican City)">Holy See (Vatican City)</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran">Iran</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jersey">Jersey</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Laos">Laos</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libyan Arab Jamahiriya">Libyan Arab Jamahiriya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macau">Macau</option>
<option value="Macedonia">Macedonia</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Man, Isle of">Man, Isle of</option>
<option value="Marshall Islands">Marshall Islands</option>
<option value="Martinique">Martinique</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mayotte">Mayotte</option>
<option value="Mexico">Mexico</option>
<option value="Moldova, Rep.">Moldova, Rep.</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Montserrat">Montserrat</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Caledonia">New Caledonia</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Niue">Niue</option>
<option value="Norfolk Island">Norfolk Island</option>
<option value="North Korea">North Korea</option>
<option value="Northern Mariana Islands">Northern Mariana Islands</option>
<option value="Norway">Norway</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palau">Palau</option>
<option value="Palestine">Palestine</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Pitcairn Islands">Pitcairn Islands</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Republic of Panama">Republic of Panama</option>
<option value="Reunion">Reunion</option>
<option value="Romania">Romania</option>
<option value="Russian Federation">Russian Federation</option>
<option value="Rwanda">Rwanda</option>
<option value="Saba">Saba</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Maarten">Saint Maarten</option>
<option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
<option value="Saint Vincent & Grenadines">Saint Vincent & Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia">Serbia</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Sint Eustatius">Sint Eustatius</option>
<option value="Slovakia">Slovakia</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="South Korea">South Korea</option>
<option value="South Sudan">South Sudan</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Suriname">Suriname</option>
<option value="Svalbard And Jan Mayen Islands">Svalbard And Jan Mayen Islands</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syria">Syria</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
<option value="Thailand">Thailand</option>
<option value="Togo">Togo</option>
<option value="Tokelau">Tokelau</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad & Tobago">Trinidad & Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Turks & Caicos Islands">Turks & Caicos Islands</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States of America">United States of America</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Venezuela">Venezuela</option>
<option value="Vietnam">Vietnam</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Wake Island">Wake Island</option>
<option value="Wallis and Futuna">Wallis and Futuna</option>
<option value="Western Sahara">Western Sahara</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
</select></div>
</div>
</div>
<div class="hs_message hs-message hs-fieldtype-textarea field hs-form-field"><label id="label-message-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your " for="message-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><textarea id="message-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="hs-input hs-fieldtype-textarea" name="message" placeholder="Details on your project"></textarea></div>
</div>
<div class="hs_campaign hs-campaign hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-campaign-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your Campaign"
for="campaign-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span>Campaign</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="campaign" class="hs-input" type="hidden" value="[COM Website request] Talk to Sales"></div>
</div>
<div class="hs_latest_form_submitted hs-latest_form_submitted hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-latest_form_submitted-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class=""
placeholder="Enter your Latest Form Submitted" for="latest_form_submitted-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span>Latest Form Submitted</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="latest_form_submitted" class="hs-input" type="hidden" value="MQL-COM-Talk to Sales"></div>
</div>
<div class="hs_utm_campaign hs-utm_campaign hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_campaign-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your utm_campaign"
for="utm_campaign-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span>utm_campaign</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_campaign" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_content hs-utm_content hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_content-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your utm_content"
for="utm_content-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span>utm_content</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_content" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_medium hs-utm_medium hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_medium-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your utm_medium"
for="utm_medium-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span>utm_medium</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_medium" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_source hs-utm_source hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_source-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your utm_source"
for="utm_source-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span>utm_source</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_source" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_term__c hs-utm_term__c hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_term__c-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="" placeholder="Enter your utm_term"
for="utm_term__c-4dbceae1-75ae-423a-9c12-dee8f1ca3345"><span>utm_term</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_term__c" class="hs-input" type="hidden" value=""></div>
</div>
<div class="legal-consent-container">
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_137766582 hs-LEGAL_CONSENT.subscription_type_137766582 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list" required="">
<li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_137766582-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_137766582-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="hs-input" type="checkbox" name="LEGAL_CONSENT.subscription_type_137766582" value="true"><span>
<p>I understand and agree that my personal data will be collected and processed according to the <a href="https://www.group-ib.com/policy.html" target="_blank">Privacy and Cookies Policy</a> and unconditionally agree and accept
the <a href="https://www.group-ib.com/term-of-use.html" target="_blank">Terms of Use</a></p><span class="hs-form-required">*</span>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_136902391 hs-LEGAL_CONSENT.subscription_type_136902391 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list">
<li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_136902391-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_136902391-4dbceae1-75ae-423a-9c12-dee8f1ca3345" class="hs-input" type="checkbox" name="LEGAL_CONSENT.subscription_type_136902391" value="true"><span>
<p>Please send me information about new product releases, price changes, and special offers from Group-IB. I am aware that my consent could be revoked at any time by clicking the unsubscribe link inside any email received from
Group-IB.</p>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Submit"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1696881499218","formDefinitionUpdatedAt":"1682070307654","lang":"en","legalConsentOptions":"{\"communicationConsentCheckboxes\":[{\"communicationTypeId\":137766582,\"label\":\"<p>I understand and agree that my personal data will be collected and processed according to the <a href=\\\"https://www.group-ib.com/policy.html\\\" target=\\\"_blank\\\">Privacy and Cookies Policy</a> and unconditionally agree and accept the <a href=\\\"https://www.group-ib.com/term-of-use.html\\\" target=\\\"_blank\\\">Terms of Use</a></p>\",\"required\":true},{\"communicationTypeId\":136902391,\"label\":\"<p>Please send me information about new product releases, price changes, and special offers from Group-IB. I am aware that my consent could be revoked at any time by clicking the unsubscribe link inside any email received from Group-IB.</p>\",\"required\":false}],\"legitimateInterestLegalBasis\":\"LEGITIMATE_INTEREST_PQL\",\"processingConsentType\":\"IMPLICIT\",\"processingConsentCheckboxLabel\":\"<p>I understand and &nbsp;agree that my personal data will be collected and processed according to the <a href=\\\"https://www.group-ib.com/policy.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Privacy and Cookies Policy</a> and unconditionally agree and accept the <a href=\\\"https://www.group-ib.com/term-of-use.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Terms of Use</a></p>\",\"isLegitimateInterest\":false}","embedType":"REGULAR","clonedFromForm":"411f9fe8-a265-46ee-87d4-af9d0bbd20d7","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36","pageTitle":"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog","pageUrl":"https://www.group-ib.com/blog/0ktapus/","referrer":"https://www.group-ib.com/blog/0ktapus/","isHubSpotCmsGeneratedPage":false,"hutk":"31d70e7cb3dd29a6d1eb5a8b6db1fef2","__hsfp":3335903367,"__hssc":"84897990.1.1696881500725","__hstc":"84897990.31d70e7cb3dd29a6d1eb5a8b6db1fef2.1696881500725.1696881500725.1696881500725.1","formTarget":"#hbspt-form-62cc391b-337e-483b-9a54-d5d3cab8b6f3","boolCheckBoxFields":"LEGAL_CONSENT.subscription_type_137766582,LEGAL_CONSENT.subscription_type_136902391","locale":"en","timestamp":1696881500757,"originalEmbedContext":{"portalId":"25755956","formId":"4dbceae1-75ae-423a-9c12-dee8f1ca3345","region":"eu1","target":"#hbspt-form-62cc391b-337e-483b-9a54-d5d3cab8b6f3","isBuilder":false,"isTestPage":false,"isPreview":false,"isMobileResponsive":true},"correlationId":"62cc391b-337e-483b-9a54-d5d3cab8b6f3","renderedFieldsIds":["product_service","email","firstname","lastname","company","position","phone","country_list","message","campaign","latest_form_submitted","utm_campaign","utm_content","utm_medium","utm_source","utm_term__c","LEGAL_CONSENT.subscription_type_137766582","LEGAL_CONSENT.subscription_type_136902391"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.3812","sourceName":"forms-embed","sourceVersion":"1.3812","sourceVersionMajor":"1","sourceVersionMinor":"3812","_debug_allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1696881499385,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog\",\"pageUrl\":\"https://www.group-ib.com/blog/0ktapus/\",\"referrer\":\"https://www.group-ib.com/blog/0ktapus/\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1696881499386,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""},{"clientTimestamp":1696881500750,"level":"INFO","message":"Retrieved analytics values from API response which may be overriden by the embed context: {\"hutk\":\"31d70e7cb3dd29a6d1eb5a8b6db1fef2\"}"}]}"><iframe
name="target_iframe_4dbceae1-75ae-423a-9c12-dee8f1ca3345" style="display: none;"></iframe>
</form>POST https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3
<form id="hsForm_5a995f05-701c-48e3-b25a-d1548ba3c0b3" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/5a995f05-701c-48e3-b25a-d1548ba3c0b3"
class="hs-form-private hsForm_5a995f05-701c-48e3-b25a-d1548ba3c0b3 hs-form-5a995f05-701c-48e3-b25a-d1548ba3c0b3 hs-form-5a995f05-701c-48e3-b25a-d1548ba3c0b3_b75afcec-b69e-4c92-81fe-d2f42c4dc7a1 hs-form stacked"
target="target_iframe_5a995f05-701c-48e3-b25a-d1548ba3c0b3" data-instance-id="b75afcec-b69e-4c92-81fe-d2f42c4dc7a1" data-form-id="5a995f05-701c-48e3-b25a-d1548ba3c0b3" data-portal-id="25755956" data-hs-cf-bound="true"
data-nb-form="f062d9c1-9b18-436f-b795-df08bc5fea86">
<div class="hs_firstname hs-firstname hs-fieldtype-text field hs-form-field"><label id="label-firstname-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your "
for="firstname-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="firstname-5a995f05-701c-48e3-b25a-d1548ba3c0b3" name="firstname" required="" placeholder="First name*" type="text" class="hs-input" inputmode="text" autocomplete="given-name" value=""></div>
</div>
<div class="hs_lastname hs-lastname hs-fieldtype-text field hs-form-field"><label id="label-lastname-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your " for="lastname-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="lastname-5a995f05-701c-48e3-b25a-d1548ba3c0b3" name="lastname" required="" placeholder="Last name*" type="text" class="hs-input" inputmode="text" autocomplete="family-name" value=""></div>
</div>
<div class="hs_company hs-company hs-fieldtype-text field hs-form-field"><label id="label-company-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your " for="company-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="company-5a995f05-701c-48e3-b25a-d1548ba3c0b3" name="company" required="" placeholder="Company*" type="text" class="hs-input" inputmode="text" autocomplete="organization" value=""></div>
</div>
<div class="hs_position hs-position hs-fieldtype-select field hs-form-field"><label id="label-position-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your "
for="position-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="position-5a995f05-701c-48e3-b25a-d1548ba3c0b3" required="" class="hs-input is-placeholder" name="position">
<option disabled="" value="">Job Title*</option>
<option value="CEO">CEO</option>
<option value="Fraud - Director/Analyst">Anti-Fraud Team</option>
<option value="Information Security - CISO/VP">Information Security - CISO/VP</option>
<option value="Information Security - Director/Head">Information Security - Director/Head</option>
<option value="Information Security - Team Lead/Manager">Information Security - Team Lead/Manager</option>
<option value="Information Security - Analyst/Engineer/Specialist/Consultant">Information Security - Analyst/Engineer/Specialist/Consultant</option>
<option value="Information Security - Other">Information Security - Other</option>
<option value="Threat Intelligence - Devision lead/Director/Head">Threat Intelligence - Devision lead/Director/Head</option>
<option value="Threat Intelligence - Analyst/Specialist/Researcher/Manager/Engineer">Threat Intelligence - Analyst/Specialist/Researcher/Manager/Engineer</option>
<option value="IT - CTO/CIO/VP">IT - CTO/CIO/VP</option>
<option value="IT - Director/Head">IT - Director/Head</option>
<option value="IT - Team Lead/Manager">IT - Team Lead/Manager</option>
<option value="IT - Analyst/Engineer/Specialist/Consultant">IT - Analyst/Engineer/Specialist/Consultant</option>
<option value="IT - Other">IT - Other</option>
<option value="Marketing/Media - CMO/Editor-in-Chief">Marketing/Media - CMO/Editor-in-Chief</option>
<option value="Marketing/Media - Director/Head/Senior Editor">Marketing/Media - Director/Head/Senior Editor</option>
<option value="Marketing/Media - Manager/Specialist/Reporter">Marketing/Media - Manager/Specialist/Reporter</option>
<option value="Marketing/Media - Other">Marketing/Media - Other</option>
<option value="Sales/Business Development - VP">Sales/Business Development - VP</option>
<option value="Sales/Business Development - Director/Head">Sales/Business Development - Director/Head</option>
<option value="Sales/Business Development - Manager">Sales/Business Development - Manager</option>
<option value="Sales/Business Development - Other">Sales/Business Development - Other</option>
<option value="HR">HR Team</option>
<option value="Legal">Legal Team</option>
<option value="Operations">Operations Team</option>
<option value="Finance">Finance Team</option>
<option value="Education">Education Team</option>
</select></div>
</div>
<div class="hs_phone hs-phone hs-fieldtype-phonenumber field hs-form-field"><label id="label-phone-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your " for="phone-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="phone-5a995f05-701c-48e3-b25a-d1548ba3c0b3" name="phone" placeholder="Phone number" type="tel" class="hs-input" inputmode="tel" autocomplete="tel" value=""></div>
</div>
<div class="hs_country_list hs-country_list hs-fieldtype-select field hs-form-field"><label id="label-country_list-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your "
for="country_list-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="country_list-5a995f05-701c-48e3-b25a-d1548ba3c0b3" required="" class="hs-input is-placeholder" name="country_list">
<option disabled="" value="">Country*</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="American Samoa">American Samoa</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Anguilla">Anguilla</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Aruba">Aruba</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermudas">Bermudas</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia">Bolivia</option>
<option value="Bonaire">Bonaire</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Bouvet Island">Bouvet Island</option>
<option value="Brazil">Brazil</option>
<option value="British Virgin Islands">British Virgin Islands</option>
<option value="Brunei">Brunei</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Christmas Island">Christmas Island</option>
<option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo (Brazzaville)">Congo (Brazzaville)</option>
<option value="Congo, Democratic Republic of the">Congo, Democratic Republic of the</option>
<option value="Cook Islands">Cook Islands</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Cote d'Ivoire (Ivory Coast)">Cote d'Ivoire (Ivory Coast)</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Curacao">Curacao</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="East Timor">East Timor</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Faroe Islands">Faroe Islands</option>
<option value="Federated States of Micronesia">Federated States of Micronesia</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Guiana">French Guiana</option>
<option value="French Polynesia">French Polynesia</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Gibraltar">Gibraltar</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guadeloupe">Guadeloupe</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guernsey and Alderney">Guernsey and Alderney</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Holy See (Vatican City)">Holy See (Vatican City)</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran">Iran</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jersey">Jersey</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Laos">Laos</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libyan Arab Jamahiriya">Libyan Arab Jamahiriya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macau">Macau</option>
<option value="Macedonia">Macedonia</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Man, Isle of">Man, Isle of</option>
<option value="Marshall Islands">Marshall Islands</option>
<option value="Martinique">Martinique</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mayotte">Mayotte</option>
<option value="Mexico">Mexico</option>
<option value="Moldova, Rep.">Moldova, Rep.</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Montserrat">Montserrat</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Caledonia">New Caledonia</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Niue">Niue</option>
<option value="Norfolk Island">Norfolk Island</option>
<option value="North Korea">North Korea</option>
<option value="Northern Mariana Islands">Northern Mariana Islands</option>
<option value="Norway">Norway</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palau">Palau</option>
<option value="Palestine">Palestine</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Pitcairn Islands">Pitcairn Islands</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Republic of Panama">Republic of Panama</option>
<option value="Reunion">Reunion</option>
<option value="Romania">Romania</option>
<option value="Russian Federation">Russian Federation</option>
<option value="Rwanda">Rwanda</option>
<option value="Saba">Saba</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Maarten">Saint Maarten</option>
<option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
<option value="Saint Vincent & Grenadines">Saint Vincent & Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia">Serbia</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Sint Eustatius">Sint Eustatius</option>
<option value="Slovakia">Slovakia</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="South Korea">South Korea</option>
<option value="South Sudan">South Sudan</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Suriname">Suriname</option>
<option value="Svalbard And Jan Mayen Islands">Svalbard And Jan Mayen Islands</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syria">Syria</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
<option value="Thailand">Thailand</option>
<option value="Togo">Togo</option>
<option value="Tokelau">Tokelau</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad & Tobago">Trinidad & Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Turks & Caicos Islands">Turks & Caicos Islands</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States of America">United States of America</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Venezuela">Venezuela</option>
<option value="Vietnam">Vietnam</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Wake Island">Wake Island</option>
<option value="Wallis and Futuna">Wallis and Futuna</option>
<option value="Western Sahara">Western Sahara</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
</select></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your " for="email-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-5a995f05-701c-48e3-b25a-d1548ba3c0b3" name="email" required="" placeholder="Business Email*" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""
data-nb-id="f062d9c1-9b18-436f-b795-df08bc5fea86"></div>
</div>
<div class="hs_message hs-message hs-fieldtype-textarea field hs-form-field"><label id="label-message-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your " for="message-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><textarea id="message-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="hs-input hs-fieldtype-textarea" name="message" placeholder="Comment"></textarea></div>
</div>
<div class="hs_campaign hs-campaign hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-campaign-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your Campaign"
for="campaign-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span>Campaign</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="campaign" class="hs-input" type="hidden" value="[COM Website request] Cybercrime Fighters Club Request"></div>
</div>
<div class="hs_latest_form_submitted hs-latest_form_submitted hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-latest_form_submitted-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class=""
placeholder="Enter your Latest Form Submitted" for="latest_form_submitted-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span>Latest Form Submitted</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="latest_form_submitted" class="hs-input" type="hidden" value="COM-Cybercrime Fighters Club Request"></div>
</div>
<div class="hs_utm_campaign hs-utm_campaign hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_campaign-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your utm_campaign"
for="utm_campaign-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span>utm_campaign</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_campaign" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_content hs-utm_content hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_content-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your utm_content"
for="utm_content-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span>utm_content</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_content" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_medium hs-utm_medium hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_medium-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your utm_medium"
for="utm_medium-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span>utm_medium</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_medium" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_source hs-utm_source hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_source-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your utm_source"
for="utm_source-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span>utm_source</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_source" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_term__c hs-utm_term__c hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_term__c-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="" placeholder="Enter your utm_term"
for="utm_term__c-5a995f05-701c-48e3-b25a-d1548ba3c0b3"><span>utm_term</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_term__c" class="hs-input" type="hidden" value=""></div>
</div>
<div class="legal-consent-container">
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_137766582 hs-LEGAL_CONSENT.subscription_type_137766582 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list" required="">
<li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_137766582-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_137766582-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="hs-input" type="checkbox" name="LEGAL_CONSENT.subscription_type_137766582" value="true"><span>
<p>I understand and agree that my personal data will be collected and processed according to the <a href="https://www.group-ib.com/policy.html" target="_blank">Privacy and Cookies Policy</a> and unconditionally agree and accept
the <a href="https://www.group-ib.com/term-of-use.html" target="_blank">Terms of Use</a></p><span class="hs-form-required">*</span>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_136902391 hs-LEGAL_CONSENT.subscription_type_136902391 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list">
<li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_136902391-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_136902391-5a995f05-701c-48e3-b25a-d1548ba3c0b3" class="hs-input" type="checkbox" name="LEGAL_CONSENT.subscription_type_136902391" value="true"><span>
<p>Please send me information about new product releases, price changes, and special offers from Group-IB. I am aware that my consent could be revoked at any time by clicking the unsubscribe link inside any email received from
Group-IB.</p>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Submit"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1696881499229","formDefinitionUpdatedAt":"1695032065845","lang":"en","legalConsentOptions":"{\"communicationConsentCheckboxes\":[{\"communicationTypeId\":137766582,\"label\":\"<p>I understand and agree that my personal data will be collected and processed according to the <a href=\\\"https://www.group-ib.com/policy.html\\\" target=\\\"_blank\\\">Privacy and Cookies Policy</a> and unconditionally agree and accept the <a href=\\\"https://www.group-ib.com/term-of-use.html\\\" target=\\\"_blank\\\">Terms of Use</a></p>\",\"required\":true},{\"communicationTypeId\":136902391,\"label\":\"<p>Please send me information about new product releases, price changes, and special offers from Group-IB. I am aware that my consent could be revoked at any time by clicking the unsubscribe link inside any email received from Group-IB.</p>\",\"required\":false}],\"legitimateInterestLegalBasis\":\"LEGITIMATE_INTEREST_PQL\",\"processingConsentType\":\"IMPLICIT\",\"processingConsentCheckboxLabel\":\"<p>I understand and &nbsp;agree that my personal data will be collected and processed according to the <a href=\\\"https://www.group-ib.com/policy.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Privacy and Cookies Policy</a> and unconditionally agree and accept the <a href=\\\"https://www.group-ib.com/term-of-use.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Terms of Use</a></p>\",\"isLegitimateInterest\":false}","embedType":"REGULAR","clonedFromForm":"bee7c6e1-7ead-4ec4-957a-ffd3bf91e03a","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36","pageTitle":"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog","pageUrl":"https://www.group-ib.com/blog/0ktapus/","referrer":"https://www.group-ib.com/blog/0ktapus/","isHubSpotCmsGeneratedPage":false,"hutk":"31d70e7cb3dd29a6d1eb5a8b6db1fef2","__hsfp":3335903367,"__hssc":"84897990.1.1696881500725","__hstc":"84897990.31d70e7cb3dd29a6d1eb5a8b6db1fef2.1696881500725.1696881500725.1696881500725.1","formTarget":"#hbspt-form-b75afcec-b69e-4c92-81fe-d2f42c4dc7a1","boolCheckBoxFields":"LEGAL_CONSENT.subscription_type_137766582,LEGAL_CONSENT.subscription_type_136902391","locale":"en","timestamp":1696881500766,"originalEmbedContext":{"portalId":"25755956","formId":"5a995f05-701c-48e3-b25a-d1548ba3c0b3","region":"eu1","target":"#hbspt-form-b75afcec-b69e-4c92-81fe-d2f42c4dc7a1","isBuilder":false,"isTestPage":false,"isPreview":false,"isMobileResponsive":true},"correlationId":"b75afcec-b69e-4c92-81fe-d2f42c4dc7a1","renderedFieldsIds":["firstname","lastname","company","position","phone","country_list","email","message","campaign","latest_form_submitted","utm_campaign","utm_content","utm_medium","utm_source","utm_term__c","LEGAL_CONSENT.subscription_type_137766582","LEGAL_CONSENT.subscription_type_136902391"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.3812","sourceName":"forms-embed","sourceVersion":"1.3812","sourceVersionMajor":"1","sourceVersionMinor":"3812","_debug_allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1696881499389,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog\",\"pageUrl\":\"https://www.group-ib.com/blog/0ktapus/\",\"referrer\":\"https://www.group-ib.com/blog/0ktapus/\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1696881499390,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""},{"clientTimestamp":1696881500759,"level":"INFO","message":"Retrieved analytics values from API response which may be overriden by the embed context: {\"hutk\":\"31d70e7cb3dd29a6d1eb5a8b6db1fef2\"}"}]}"><iframe
name="target_iframe_5a995f05-701c-48e3-b25a-d1548ba3c0b3" style="display: none;"></iframe>
</form>POST https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349
<form id="hsForm_55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"
class="hs-form-private hsForm_55a22738-d5a5-43f9-9c1c-fa4c1a6eb349 hs-form-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349 hs-form-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349_9da7d3fe-d0ea-4f23-8367-7f08799b755b hs-form stacked"
target="target_iframe_55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" data-instance-id="9da7d3fe-d0ea-4f23-8367-7f08799b755b" data-form-id="55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" data-portal-id="25755956" data-hs-cf-bound="true"
data-nb-form="121a6f3a-a8e1-491d-97ec-63e89dc1b635">
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="" placeholder="Enter your " for="email-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" name="email" required="" placeholder="Business Email*" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""
data-nb-id="121a6f3a-a8e1-491d-97ec-63e89dc1b635"></div>
</div>
<div class="hs_latest_form_submitted hs-latest_form_submitted hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-latest_form_submitted-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class=""
placeholder="Enter your Latest Form Submitted" for="latest_form_submitted-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span>Latest Form Submitted</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="latest_form_submitted" class="hs-input" type="hidden" value="COM-Footer Subscription"></div>
</div>
<div class="hs_utm_campaign hs-utm_campaign hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_campaign-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="" placeholder="Enter your utm_campaign"
for="utm_campaign-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span>utm_campaign</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_campaign" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_content hs-utm_content hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_content-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="" placeholder="Enter your utm_content"
for="utm_content-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span>utm_content</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_content" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_medium hs-utm_medium hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_medium-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="" placeholder="Enter your utm_medium"
for="utm_medium-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span>utm_medium</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_medium" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_source hs-utm_source hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_source-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="" placeholder="Enter your utm_source"
for="utm_source-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span>utm_source</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_source" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_term__c hs-utm_term__c hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_term__c-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="" placeholder="Enter your utm_term"
for="utm_term__c-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span>utm_term</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_term__c" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_languagemailing__c hs-languagemailing__c hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-languagemailing__c-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="" placeholder="Enter your Language (Mailing)"
for="languagemailing__c-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span>Language (Mailing)</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="languagemailing__c" class="hs-input" type="hidden" value="English"></div>
</div>
<div class="hs_country hs-country hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-country-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="" placeholder="Enter your Country/Region"
for="country-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349"><span>Country/Region</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="country" class="hs-input" type="hidden" value=""></div>
</div>
<div class="legal-consent-container">
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_152429613 hs-LEGAL_CONSENT.subscription_type_152429613 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list" required="">
<li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_152429613-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_152429613-55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" class="hs-input" type="checkbox" name="LEGAL_CONSENT.subscription_type_152429613" value="true"><span>
<p>I understand and agree that my personal data will be collected and processed according to the <a href="https://www.group-ib.com/policy.html" target="_blank" rel="noopener">Privacy and Cookies Policy</a> and unconditionally
agree and accept the <a href="https://www.group-ib.com/term-of-use.html" target="_blank" rel="noopener">Terms of Use</a></p><span class="hs-form-required">*</span>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value=" "></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1696881499284","formDefinitionUpdatedAt":"1679474705664","lang":"en","legalConsentOptions":"{\"communicationConsentCheckboxes\":[{\"communicationTypeId\":152429613,\"label\":\"<p>I understand and agree that my personal data will be collected and processed according to the <a href=\\\"https://www.group-ib.com/policy.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Privacy and Cookies Policy</a> and unconditionally agree and accept the <a href=\\\"https://www.group-ib.com/term-of-use.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Terms of Use</a></p>\",\"required\":true}],\"legitimateInterestLegalBasis\":\"LEGITIMATE_INTEREST_PQL\",\"processingConsentType\":\"IMPLICIT\",\"processingConsentCheckboxLabel\":\"<p>I agree to allow Group-IB to store and process my personal data.</p>\",\"isLegitimateInterest\":false}","embedType":"REGULAR","disableCookieSubmission":"true","clonedFromForm":"66912349-dc7b-4de8-8f33-8dc6bd2dd1ca","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36","pageTitle":"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog","pageUrl":"https://www.group-ib.com/blog/0ktapus/","referrer":"https://www.group-ib.com/blog/0ktapus/","isHubSpotCmsGeneratedPage":false,"hutk":"31d70e7cb3dd29a6d1eb5a8b6db1fef2","__hsfp":3335903367,"__hssc":"84897990.1.1696881500725","__hstc":"84897990.31d70e7cb3dd29a6d1eb5a8b6db1fef2.1696881500725.1696881500725.1696881500725.1","formTarget":"#hbspt-form-9da7d3fe-d0ea-4f23-8367-7f08799b755b","boolCheckBoxFields":"LEGAL_CONSENT.subscription_type_152429613","locale":"en","timestamp":1696881500773,"originalEmbedContext":{"portalId":"25755956","formId":"55a22738-d5a5-43f9-9c1c-fa4c1a6eb349","region":"eu1","target":"#hbspt-form-9da7d3fe-d0ea-4f23-8367-7f08799b755b","isBuilder":false,"isTestPage":false,"isPreview":false,"isMobileResponsive":true},"correlationId":"9da7d3fe-d0ea-4f23-8367-7f08799b755b","renderedFieldsIds":["email","latest_form_submitted","utm_campaign","utm_content","utm_medium","utm_source","utm_term__c","languagemailing__c","country","LEGAL_CONSENT.subscription_type_152429613"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.3812","sourceName":"forms-embed","sourceVersion":"1.3812","sourceVersionMajor":"1","sourceVersionMinor":"3812","_debug_allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1696881499393,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog\",\"pageUrl\":\"https://www.group-ib.com/blog/0ktapus/\",\"referrer\":\"https://www.group-ib.com/blog/0ktapus/\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1696881499394,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""},{"clientTimestamp":1696881500767,"level":"INFO","message":"Retrieved analytics values from API response which may be overriden by the embed context: {\"hutk\":\"31d70e7cb3dd29a6d1eb5a8b6db1fef2\"}"}]}"><iframe
name="target_iframe_55a22738-d5a5-43f9-9c1c-fa4c1a6eb349" style="display: none;"></iframe>
</form>POST https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0
<form id="hsForm_eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms-eu1.hsforms.com/submissions/v3/public/submit/formsnext/multipart/25755956/eb903dab-0ef3-43b5-bdeb-71372e6ad0f0"
class="hs-form-private hsForm_eb903dab-0ef3-43b5-bdeb-71372e6ad0f0 hs-form-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0 hs-form-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0_deff9fb3-f82f-4718-bdd4-eece110649ed hs-form stacked"
target="target_iframe_eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" data-instance-id="deff9fb3-f82f-4718-bdd4-eece110649ed" data-form-id="eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" data-portal-id="25755956" data-hs-cf-bound="true"
data-nb-form="8b1bb8e8-757c-4f7f-81d4-0d679a32a3c8">
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class="" placeholder="Enter your " for="email-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0"><span></span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" name="email" required="" placeholder="Business Email*" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""
data-nb-id="8b1bb8e8-757c-4f7f-81d4-0d679a32a3c8"></div>
</div>
<div class="hs_latest_form_submitted hs-latest_form_submitted hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-latest_form_submitted-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class=""
placeholder="Enter your Latest Form Submitted" for="latest_form_submitted-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0"><span>Latest Form Submitted</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="latest_form_submitted" class="hs-input" type="hidden" value="COM-Subscription"></div>
</div>
<div class="hs_utm_campaign hs-utm_campaign hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_campaign-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class="" placeholder="Enter your utm_campaign"
for="utm_campaign-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0"><span>utm_campaign</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_campaign" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_content hs-utm_content hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_content-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class="" placeholder="Enter your utm_content"
for="utm_content-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0"><span>utm_content</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_content" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_medium hs-utm_medium hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_medium-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class="" placeholder="Enter your utm_medium"
for="utm_medium-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0"><span>utm_medium</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_medium" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_source hs-utm_source hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_source-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class="" placeholder="Enter your utm_source"
for="utm_source-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0"><span>utm_source</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_source" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_utm_term__c hs-utm_term__c hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-utm_term__c-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class="" placeholder="Enter your utm_term"
for="utm_term__c-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0"><span>utm_term</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="utm_term__c" class="hs-input" type="hidden" value=""></div>
</div>
<div class="legal-consent-container">
<div>
<div class="hs-dependent-field">
<div class="hs_LEGAL_CONSENT.subscription_type_152429613 hs-LEGAL_CONSENT.subscription_type_152429613 hs-fieldtype-booleancheckbox field hs-form-field">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input">
<ul class="inputs-list" required="">
<li class="hs-form-booleancheckbox"><label for="LEGAL_CONSENT.subscription_type_152429613-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class="hs-form-booleancheckbox-display"><input
id="LEGAL_CONSENT.subscription_type_152429613-eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" class="hs-input" type="checkbox" name="LEGAL_CONSENT.subscription_type_152429613" value="true"><span>
<p>I understand and agree that my personal data will be collected and processed according to the <a href="https://www.group-ib.com/policy.html" target="_blank" rel="noopener">Privacy and Cookies Policy</a> and
unconditionally agree and accept the <a href="https://www.group-ib.com/term-of-use.html" target="_blank" rel="noopener">Terms of Use</a></p><span class="hs-form-required">*</span>
</span></label></li>
</ul>
</div>
</div>
</div>
<legend class="hs-field-desc checkbox-desc" style="display: none;"></legend>
</div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value=" "></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1696881499310","formDefinitionUpdatedAt":"1679474627070","lang":"en","legalConsentOptions":"{\"communicationConsentCheckboxes\":[{\"communicationTypeId\":152429613,\"label\":\"<p>I understand and &nbsp;agree that my personal data will be collected and processed according to the <a href=\\\"https://www.group-ib.com/policy.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Privacy and Cookies Policy</a> and unconditionally agree and accept the <a href=\\\"https://www.group-ib.com/term-of-use.html\\\" target=\\\"_blank\\\" rel=\\\"noopener\\\">Terms of Use</a></p>\",\"required\":true}],\"legitimateInterestLegalBasis\":\"LEGITIMATE_INTEREST_PQL\",\"processingConsentType\":\"IMPLICIT\",\"processingConsentCheckboxLabel\":\"<p>I agree to allow Group-IB to store and process my personal data.</p>\",\"isLegitimateInterest\":false}","embedType":"REGULAR","disableCookieSubmission":"true","clonedFromForm":"55a22738-d5a5-43f9-9c1c-fa4c1a6eb349","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36","pageTitle":"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog","pageUrl":"https://www.group-ib.com/blog/0ktapus/","referrer":"https://www.group-ib.com/blog/0ktapus/","isHubSpotCmsGeneratedPage":false,"hutk":"31d70e7cb3dd29a6d1eb5a8b6db1fef2","__hsfp":3335903367,"__hssc":"84897990.1.1696881500725","__hstc":"84897990.31d70e7cb3dd29a6d1eb5a8b6db1fef2.1696881500725.1696881500725.1696881500725.1","formTarget":"#hbspt-form-deff9fb3-f82f-4718-bdd4-eece110649ed","boolCheckBoxFields":"LEGAL_CONSENT.subscription_type_152429613","locale":"en","timestamp":1696881500780,"originalEmbedContext":{"portalId":"25755956","formId":"eb903dab-0ef3-43b5-bdeb-71372e6ad0f0","region":"eu1","target":"#hbspt-form-deff9fb3-f82f-4718-bdd4-eece110649ed","isBuilder":false,"isTestPage":false,"isPreview":false,"isMobileResponsive":true},"correlationId":"deff9fb3-f82f-4718-bdd4-eece110649ed","renderedFieldsIds":["email","latest_form_submitted","utm_campaign","utm_content","utm_medium","utm_source","utm_term__c","LEGAL_CONSENT.subscription_type_152429613"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.3812","sourceName":"forms-embed","sourceVersion":"1.3812","sourceVersionMajor":"1","sourceVersionMinor":"3812","_debug_allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1696881499401,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"All about the phishing campaign that compromised over 130 organizations and the resources involved (phishing domains, kits, and tools, and more) | Group-IB Blog\",\"pageUrl\":\"https://www.group-ib.com/blog/0ktapus/\",\"referrer\":\"https://www.group-ib.com/blog/0ktapus/\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1696881499402,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""},{"clientTimestamp":1696881500774,"level":"INFO","message":"Retrieved analytics values from API response which may be overriden by the embed context: {\"hutk\":\"31d70e7cb3dd29a6d1eb5a8b6db1fef2\"}"}]}"><iframe
name="target_iframe_eb903dab-0ef3-43b5-bdeb-71372e6ad0f0" style="display: none;"></iframe>
</form>Text Content
Report an incident
Get 24/7 incident response assistance from our global team
* APAC: +65 3159 4398
* EU & NA: +31 20 226 90 90
* MEA: +971 4 568 1785
Latest Form Submitted
utm_campaign
utm_content
utm_medium
utm_source
utm_term
* I understand and agree that my personal data will be collected and processed
according to the Privacy and Cookies Policy and unconditionally agree and
accept the Terms of Use
*
Talk to sales
Just fill out the form, and our representative will contact you soon.
Please choose a product/service you are interested in*Attack Surface
ManagementBusiness Email ProtectionDigital Risk ProtectionEducationFraud
ProtectionIncident ResponseInvestigationsManaged XDRSecurity AuditThreat
Intelligence
Job Title*CEOAnti-Fraud TeamInformation Security - CISO/VPInformation Security -
Director/HeadInformation Security - Team Lead/ManagerInformation Security -
Analyst/Engineer/Specialist/ConsultantInformation Security - OtherThreat
Intelligence - Devision lead/Director/HeadThreat Intelligence -
Analyst/Specialist/Researcher/Manager/EngineerIT - CTO/CIO/VPIT -
Director/HeadIT - Team Lead/ManagerIT - Analyst/Engineer/Specialist/ConsultantIT
- OtherMarketing/Media - CMO/Editor-in-ChiefMarketing/Media -
Director/Head/Senior EditorMarketing/Media -
Manager/Specialist/ReporterMarketing/Media - OtherSales/Business Development -
VPSales/Business Development - Director/HeadSales/Business Development -
ManagerSales/Business Development - OtherHR TeamLegal TeamOperations TeamFinance
TeamEducation Team
Country*AfghanistanAlbaniaAlgeriaAmerican SamoaAndorraAngolaAnguillaAntigua and
BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudasBhutanBoliviaBonaireBosnia
and HerzegovinaBotswanaBouvet IslandBrazilBritish Virgin
IslandsBruneiBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman
IslandsCentral African RepublicChadChileChinaChristmas IslandCocos (Keeling)
IslandsColombiaComorosCongo (Brazzaville)Congo, Democratic Republic of theCook
IslandsCosta RicaCote d'Ivoire (Ivory Coast)CroatiaCubaCuracaoCyprusCzech
RepublicDenmarkDjiboutiDominicaDominican RepublicEast TimorEcuadorEgyptEl
SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFaroe IslandsFederated States of
MicronesiaFijiFinlandFranceFrench GuianaFrench
PolynesiaGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernsey
and AlderneyGuineaGuinea-BissauGuyanaHaitiHoly See (Vatican City)HondurasHong
KongHungaryIcelandIndiaIndonesiaIranIraqIrelandIsraelItalyJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKosovoKuwaitKyrgyzstanLaosLatviaLebanonLesothoLiberiaLibyan
Arab
JamahiriyaLiechtensteinLithuaniaLuxembourgMacauMacedoniaMadagascarMalawiMalaysiaMaldivesMaliMaltaMan,
Isle ofMarshall IslandsMartiniqueMauritaniaMauritiusMayotteMexicoMoldova,
Rep.MonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew
CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorth KoreaNorthern
Mariana IslandsNorwayOmanPakistanPalauPalestinePapua New
GuineaParaguayPeruPhilippinesPitcairn IslandsPolandPortugalPuerto
RicoQatarRepublic of PanamaReunionRomaniaRussian FederationRwandaSabaSaint Kitts
and NevisSaint LuciaSaint MaartenSaint Pierre and MiquelonSaint Vincent &
GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi
ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSint
EustatiusSlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSouth KoreaSouth
SudanSpainSri LankaSudanSurinameSvalbard And Jan Mayen
IslandsSwazilandSwedenSwitzerlandSyriaTaiwanTajikistanTanzania, United Republic
ofThailandTogoTokelauTongaTrinidad & TobagoTunisiaTurkeyTurkmenistanTurks &
Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUnited States
of AmericaUruguayUzbekistanVanuatuVenezuelaVietnamVirgin Islands, U.S.Wake
IslandWallis and FutunaWestern SaharaYemenZambiaZimbabwe
Campaign
Latest Form Submitted
utm_campaign
utm_content
utm_medium
utm_source
utm_term
* I understand and agree that my personal data will be collected and processed
according to the Privacy and Cookies Policy and unconditionally agree and
accept the Terms of Use
*
* Please send me information about new product releases, price changes, and
special offers from Group-IB. I am aware that my consent could be revoked at
any time by clicking the unsubscribe link inside any email received from
Group-IB.
Join the Cybercrime Fighters Club
Job Title*CEOAnti-Fraud TeamInformation Security - CISO/VPInformation Security -
Director/HeadInformation Security - Team Lead/ManagerInformation Security -
Analyst/Engineer/Specialist/ConsultantInformation Security - OtherThreat
Intelligence - Devision lead/Director/HeadThreat Intelligence -
Analyst/Specialist/Researcher/Manager/EngineerIT - CTO/CIO/VPIT -
Director/HeadIT - Team Lead/ManagerIT - Analyst/Engineer/Specialist/ConsultantIT
- OtherMarketing/Media - CMO/Editor-in-ChiefMarketing/Media -
Director/Head/Senior EditorMarketing/Media -
Manager/Specialist/ReporterMarketing/Media - OtherSales/Business Development -
VPSales/Business Development - Director/HeadSales/Business Development -
ManagerSales/Business Development - OtherHR TeamLegal TeamOperations TeamFinance
TeamEducation Team
Country*AfghanistanAlbaniaAlgeriaAmerican SamoaAndorraAngolaAnguillaAntigua and
BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudasBhutanBoliviaBonaireBosnia
and HerzegovinaBotswanaBouvet IslandBrazilBritish Virgin
IslandsBruneiBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman
IslandsCentral African RepublicChadChileChinaChristmas IslandCocos (Keeling)
IslandsColombiaComorosCongo (Brazzaville)Congo, Democratic Republic of theCook
IslandsCosta RicaCote d'Ivoire (Ivory Coast)CroatiaCubaCuracaoCyprusCzech
RepublicDenmarkDjiboutiDominicaDominican RepublicEast TimorEcuadorEgyptEl
SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFaroe IslandsFederated States of
MicronesiaFijiFinlandFranceFrench GuianaFrench
PolynesiaGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernsey
and AlderneyGuineaGuinea-BissauGuyanaHaitiHoly See (Vatican City)HondurasHong
KongHungaryIcelandIndiaIndonesiaIranIraqIrelandIsraelItalyJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKosovoKuwaitKyrgyzstanLaosLatviaLebanonLesothoLiberiaLibyan
Arab
JamahiriyaLiechtensteinLithuaniaLuxembourgMacauMacedoniaMadagascarMalawiMalaysiaMaldivesMaliMaltaMan,
Isle ofMarshall IslandsMartiniqueMauritaniaMauritiusMayotteMexicoMoldova,
Rep.MonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew
CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorth KoreaNorthern
Mariana IslandsNorwayOmanPakistanPalauPalestinePapua New
GuineaParaguayPeruPhilippinesPitcairn IslandsPolandPortugalPuerto
RicoQatarRepublic of PanamaReunionRomaniaRussian FederationRwandaSabaSaint Kitts
and NevisSaint LuciaSaint MaartenSaint Pierre and MiquelonSaint Vincent &
GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi
ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSint
EustatiusSlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSouth KoreaSouth
SudanSpainSri LankaSudanSurinameSvalbard And Jan Mayen
IslandsSwazilandSwedenSwitzerlandSyriaTaiwanTajikistanTanzania, United Republic
ofThailandTogoTokelauTongaTrinidad & TobagoTunisiaTurkeyTurkmenistanTurks &
Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUnited States
of AmericaUruguayUzbekistanVanuatuVenezuelaVietnamVirgin Islands, U.S.Wake
IslandWallis and FutunaWestern SaharaYemenZambiaZimbabwe
Campaign
Latest Form Submitted
utm_campaign
utm_content
utm_medium
utm_source
utm_term
* I understand and agree that my personal data will be collected and processed
according to the Privacy and Cookies Policy and unconditionally agree and
accept the Terms of Use
*
* Please send me information about new product releases, price changes, and
special offers from Group-IB. I am aware that my consent could be revoked at
any time by clicking the unsubscribe link inside any email received from
Group-IB.
* Products
Threat Intelligence
Attack Surface Management
Fraud Protection
Digital Risk Protection
Managed XDR
Business Email Protection
Learn more information about our Unified Risk Platform
* Services
Digital Forensics
& Incident Response
* Incident Response
* Incident Response
Retainer
* Incident Response
Readiness Assessment
* Compromise Assessment
* Digital Forensics
Hi-Tech Crime
Investigation
* Cyber Investigation
* Investigation Subscription
Audit
& Consulting
* Penetration Testing
* Security Assessment
* Compliance Audit & Consulting
* Red Teaming
Education
& Training
* Training for Technical Specialists
* Cybersecurity Awareness Workshop
* Incident Response Simulation Game
* All Training Programs
* Solutions
Use Case
* Ransomware Protection and Response
* Phishing and Scam Protection
* Bot Protection
* Subscription Plans
* Resources
* Research Hub
* Knowledge Hub
* Certificates
* Webinars
* Free Tools
* Email Security Assessment
* Network Protection Assessment
* Cloud Recon Tool
* Blog
* Company
* About Group-IB
* CERT-GIB
* Team
* Partners
* MSSP and MDR Partner Program
* Careers
* Internship
* Media Center
* Contact
* Subscription Plans
* Blog
* Report an incident
* Talk to sales
* Search
* Sign in
Share this article
Found it interesting? Don't hesitate to share it to wow your friends or
colleagues
* Twitter
* LinkedIn
* Telegram
*
← Blog
Share this article
Found it interesting? Don't hesitate to share it to wow your friends or
colleagues
* Twitter
* LinkedIn
* Telegram
*
Rustam Mirkasymov
Head of cyber threat research, Group-IB (Europe)
Roberto Martinez
Sr. Threat Intelligence Analyst, Group-IB (Europe)
ROASTING 0KTAPUS: THE PHISHING CAMPAIGN GOING AFTER OKTA IDENTITY CREDENTIALS
Over 130 organizations have been compromised in a sophisticated attack using
simple phishing kits
August 25, 2022 · 12 min to read · Threat Intelligence
0ktapus
Phishing
Threat Intelligence
Multi-factor authentication (MFA) is often implemented as a form of enterprise
identity security to protect organizations against credential theft , dictionary
attacks, and brute force techniques. But what if MFA is intercepted by a
fraudster? In the cyber arena, where there is a continuous arms race with
offensive and defensive strategies trying to outcompete each other, techniques
that overcome MFA have existed for some time. In this blog, we share the
techniques that utilize surprisingly simple tools that were used to overcome
enterprise identity access management (IAM) and conduct supply chain attacks.
INTRODUCTION
For many years, cybercriminals have used social engineering and phishing attacks
to trick unsuspected victims into providing their credentials. These credentials
have been used to provide cybercriminals with access to a wide range of company
resources for a number of well-documented purposes. To remain ahead of threat
actors, and in its mission to fight all types of cybercrime, Group-IB helps
organizations protect their digital assets and identify the miscreants targeting
them by investigating phishing attacks.
On July 26, 2022, Group-IB intelligence analysts received a request from a
client of our Threat Intelligence solution asking for additional information on
a recent phishing attack that they had experienced. The investigation started
after the client provided domain names and IP addresses used in the attack.
Using a combination of Group-IB Threat Intelligence, and in-house and public
tools we were able to obtain a list of domains that had been attacked. Our
client was only one of several well-known organizations that were targeted in a
massive phishing campaign codenamed 0ktapus by Group-IB researchers. The initial
objective of the attackers was clear: obtain Okta identity credentials and
two-factor authentication (2FA) codes from users of the targeted organizations.
With this information in hand, the attackers could gain unauthorized access to
any enterprise resources the victims have access to.
This case is of interest because despite using low-skill methods it was able to
compromise a large number of well-known organizations. Furthermore, once the
attackers compromised an organization they were quickly able to pivot and launch
subsequent supply chain attacks, indicating that the attack was planned
carefully in advance.
Group-IB decided to make its research on 0ktapus publicly available when Signal
reported 1,900 of their user’s accounts were probably hacked. We hope this blog
will provide a better understanding of what happened and will give useful
recommendations on how to prevent your organization from becoming a victim.
ATTACK SCHEME OVERVIEW
Based on the request from our client, and from public reports made by Twilio and
Cloudflare, the attacks were well designed and executed. The attackers targeted
employees of companies that are customers of IAM leader Okta. These employees
received text messages containing links to phishing sites that mimicked the Okta
authentication page of their organization. Examples of observed phishing SMS
messages can be found in the two public reports mentioned above.
DEEP DIVE INTO THE ATTACK
PHISHING SITES
In total, the Group-IB Threat Intelligence team detected 169 unique domains
involved in the 0ktapus campaign. When analyzing these phishing sites, Group-IB
analysts pay attention to all resources being used. On many occasions, there are
images, fonts or scripts that are unique enough that they can be used to find
other sites using the same phishing kit. In this case, we found an image that is
legitimately used by sites leveraging Okta authentication, being used by the
phishing kit.
If we correlate the hash value of this image with the keyword “_nuxt” (which is
a folder name utilized by the frontend of the phishing kit), we can obtain a
unique list of related domains. These domains were all used by the attackers to
target organizations in multiple industries, located mostly in the United States
and Canada. Based on the fact that many of these organizations use Okta’s
Identity and Access Management services to secure access to enterprise
resources, we named this campaign 0ktapus.
At this time, it became very clear that the threat actors’ immediate intentions
were to gain access to the corporate services of the organizations.
Figure 1: Web resource found in all of the sites emulating Okta authentication
pages involved in the phishing campaigns
Figure 2: Sample of phishing sites found that emulate Okta authentication pages
Interestingly, the domains being registered for the attacks used keywords like
sso, vpn, okta, mfa, and help. Although, those are commonly used keywords, on
occasions other keywords are used, or no keywords at all. As part of best
practices, we also started tracking those keywords. However, often we only need
to discover one domain to find the others.
From the victim’s point of view, the phishing site looks quite convincing as it
is very similar to the authentication page they are used to seeing. Victims are
prompted for their username and password, and once provided a second page is
shown asking for their 2FA code. Once the code has been handed to the phishers,
the browser is forced to download a legitimate copy of the remote administration
tool AnyDesk. It is still unknown the true purpose of pushing AnyDesk.exe to the
victim’s asset, especially when the phishing link was sent via SMS to a mobile
phone. Thus we decided the attacker didn’t configure the phishing kit properly
in order to target mobile devices. That may indicate that the attacker is
inexperienced.
Figure 3: Example of a phishing site emulating the Okta authentication page of a
target organization
The frontend of the phishing sites uses the Nuxt.js framework while the backend
uses Django, running on port 8080.
Figure 4: Django admin interface running on port 8080 that was used in phishing
attack that emulated Okta authentication pages
The phishing site is static, meaning attackers cannot interact with victims in
real-time like more sophisticated phishing kits do. However, to gain access
before the 2FA codes expire, the attackers need to use the compromised data as
soon as they get it. Most likely, this means that attackers were continuously
monitoring their tools and using the credentials as soon as they received them.
PHISHING KIT ANALYSIS
With an efficient way to find new phishing sites, the next step was to locate a
copy of the phishing kit being used. For this, we used Virustotal. It is well
known that even cyber criminals use the popular antivirus scan service. A search
for the hash of the image we were using to track phishing domains resulted in
many false positives and one true positive. It appears that the miscreants had
shared the kit among themselves using the file hosting service Pomf.cat and one
of them scanned the link with Virustotal to make sure there was no malware in
it.
With a copy of the phishing kit in our possession, we were ready to start
digging and get a better understanding of the threat our client was facing.
Figure 5: Phishing kit structure, that emulated Okta authentication pages, used
by the attacker in their campaigns
Figure 6: Phishing kit structure, that emulated Okta authentication pages, used
by the attacker in their campaigns
Nowadays, many phishing actors prefer to use kits that deliver the compromised
data obtained from victims to a Telegram channel controlled by them. Therefore,
we were not too surprised to see that this kit was not any different. Hiding at
the end of the file containing the settings for Django, were a few lines
dedicated to the configuration of the Telegram bot and the channel used by the
kit to drop compromised data.
Figure 7: Function to send compromised data to Telegram used by the attackers to
send credentials to themselves from the emulated Okta authentication pages in
their phishing campaigns
ANALYSIS OF COMPROMISED DATA
Group-IB utilized patented technologies implemented in Threat Intelligence
service to uncover the information obtained from all 0ktapus campaigns launched
since March 2022. The analysis of compromised credentials sheds light on targets
and helps us understand the attacks’ potential impact.
Breakdown of compromised victims Compromised user credentials 9931 Compromised
user credentials with email 3120 Compromised user credentials without email 6811
Compromised MFA codes 5441 Unique email domains that compromised users belonged
to 136
The analysis shows that most targeted companies are located in the USA. That
list also includes companies that are headquartered in other countries but have
US-based employees that were targeted.
Unfortunately, we didn’t manage to identify all targeted companies, because ⅔ of
the data didn’t contain a corporate email, but only usernames and 2FA codes. In
those cases, we could only identify the region of residence of the victims.
Most companies in the victims’ list are providing IT, software development, and
cloud services. As described in Twilio’s blog, the attackers try to obtain
credentials in order to access private data, corporate emails and internal
documents.
Seeing financial companies in the compromised list gives us the idea that the
attackers were also trying to steal money. Furthermore, some of the targeted
companies provide access to crypto assets and markets, whereas others develop
investment tools.
Based on recent news about hacked Signal accounts, we can assume the fraudsters
may try to get access to private conversations and data. That information can be
used as business intelligence and reselled to the victim’s competitors or could
be used to ransom a victim.
According to published blogs by Twillio and Cloudflare, victims received SMS
with phishing links. It is still unknown how fraudsters prepared their target
list and how they obtained the phone numbers. But, according to the compromised
data we analyzed, the actors started their attacks targeting mobile operators
and telecommunications companies. Chances are, some phone numbers may have been
obtained from those initial attacks.
SUPPLY CHAIN ATTACKS
Recent disclosures reveal that the initial compromises were just part of the
attack. In many cases the attacker targeted mailing lists or customer-facing
systems in order to launch supply chain attacks:
* Marketing firm Klaviyo was breached and personal information connected to
cryptocurrency-related accounts, reportedly including names, addresses,
emails, and phone numbers, was stolen. This information could be used in
order to steal cryptocurrency.
* Email platform Mailchimp was breached to gain access to data from
crypto-related companies and disrupt operations. Mailchimp was used by
technology firm DigitalOcean to send confirmation emails, password resets,
email-based alerts. By initiating and redirecting password resets the
customers of DigitalOcean could have been compromised.
* Phone number verification provider Twilio was breached, which allowed the
attacker to attempt to re-register Signal accounts to new mobile devices.
While it is possible that the threat actor may have been lucky in their attacks
it is far more likely that they carefully crafted their attacks in order to
launch the sophisticated supply chain attacks outlined above. It is not yet
clear if the attacks were planned end-to-end in advance or whether opportunistic
actions were taken at each stage. Regardless, it is clear that the attack has
been incredibly successful and the full scale of the attack may not be known for
some time.
SUBJECT X
Using Telegram features, it is possible to get some information about the
channel used by the phishing kit to collect compromised data, such as its name
and the users administering it.
Figure 8: Telegram channel used as drop for credentials by the attackers in
their phishing campaigns emulating Okta authentication pages
Figure 9: Administrators of the Telegram channel “Okta” used by attackers in
their phishing campaigns that emulated Okta authentication pages
Unfortunately, there was no useful information on the first Telegram account,
but luck was on our side with the second one. For now, we will call the creator
of the “Okta” channel, Subject X, allegedly a 22-year-old software developer.
Figure 10: Subject X’s Telegram account
Using Group-IB Threat Intelligence to monitor Telegram channels used by
cybercriminals, we were able to identify a few channels where Subject X was
active at some point. One of the posts made by Subject X in 2019 led us to his
Twitter account. The same tool also gave us the name and last name the
administrator of the channel was using, before adopting the name “X”.
Figure 11: Telegram post showing the Twitter account of Subject X
Figure 12: Subject X’s Twitter account
Looking up the Twitter handle on Google gives back a GitHub account containing
the same username and profile picture. This account also suggests the location
of Subject X is North Carolina, United States.
Figure 13: Subject X’s GitHub account
From here, we went down the rabbit hole of Internet clues that led us to the
alleged identity of Subject X.
RECOMMENDATIONS TO AVOID BECOMING A VICTIM
Maintaining a secure organization requires ongoing vigilance. Security measures
such as MFA can appear secure but it is clear that attackers can overcome them
with relatively simple tools. Using Group-IB Threat Intelligence helps maintain
a strong security posture by equipping security teams and tools with the latest
insight into attackers.
Group-IB recommends the following to mitigate similar attacks:
* End users should always check, carefully, the URL of the site where you are
entering your credentials. This is especially important for users with
privileged accounts.
* Treat all URLs that were received from unknown sources as suspicious. If in
doubt, forward them to your security team for analysis.
* Implement a FIDO2-compliant security key from a vendor like YubiKey for
multi-factor authentication, like Cloudflare suggests
* If you think your credentials might have been compromised, immediately change
your password, sign off from all active sessions, and report the incident to
your manager and security team.
In line with Group-IB’s mission of fighting cybercrime, we will continue to
explore the methods, tools, and tactics used by these phishing actors. We will
also continue to inform and warn targeted organizations worldwide. We always
strive to ensure that organizations under attack are notified as quickly as
possible to help reduce potential damage. We also consider it our responsibility
to share our findings with the cybersecurity community and encourage researchers
to study advanced threats, share data, and use our technologies to combat
cybercrime — together.
If you are interested in what we do and would like to become an expert in the
same field, you can take our Digital Forensics, Incident Response, and Threat
Intelligence training courses. We also welcome applications to join the Group-IB
team. Please check our vacancies on the website.
TRY GROUP-IB THREAT INTELLIGENCE NOW!
Optimize strategic, operational and tactical decision-making with best-in-class
cyber threat analytics
Test Drive Group-IB Threat Intelligence
IOCS
IP C&C domains 45[.]76[.]80[.]199 twiiio-sso[.]com, box-okta[.]org,
kucoin-pin[.]com, boxokta[.]com, kucoin-sso[.]com 66[.]42[.]107[.]233
slack-mailchimp[.]com 45[.]32[.]66[.]165 microsoft-sso[.]net,
sendgrid-okta[.]org, mlcrosoft[.]info, mlcrosoft[.]cloud 45[.]76[.]238[.]53
ouryahoo-okta[.]org, ouryahooinc-okta[.]com 155[.]138[.]240[.]251
sykes-sso[.]com, internai-customer[.]io, ouryahoo-okta[.]com,
ouryahoo-okta[.]net, techmahindra-sso[.]com 149[.]28[.]37[.]137
qualfon-sso[.]com, twiiio[.]net, twiiio[.]org, teleperformanceusa-sso[.]com,
tmo-sso[.]net, okta-sso[.]net 149[.]248[.]1[.]50 att-mfa[.]com, att-rsa[.]com
108[.]61[.]119[.]20 mcsupport-okta[.]com, mailgun-okta[.]com, sprint-idg[.]net
149[.]28[.]212[.]53 tmobie[.]net 140[.]82[.]63[.]209 kucoinpin[.]com,
kucoinpin[.]net, twiiio-okta[.]net 144[.]202[.]82[.]47 kucoin-pin[.]net,
kucoin-sso[.]net 45[.]63[.]39[.]116 telus-sso[.]com 149[.]248[.]62[.]54
rogers-rci[.]net, rogers-ssp[.]com, iqor-duo[.]net, iqor-portal[.]com,
cgslnc-okta[.]com, conexusonline[.]com, klaviyo-sso[.]com 66[.]42[.]91[.]138
arise-okta[.]com 216[.]128[.]141[.]52 rogers-rci[.]com, verizon-sso[.]net,
taskus-sso[.]com 45[.]63[.]39[.]151 medailia-okta[.]com, quaifone[.]com,
quaifon[.]com, t-moblle[.]org, iqor-sso[.]com, rogers-sso[.]net, tmo-sso[.]com
143[.]244[.]178[.]172 teleperformance-help[.]com 66[.]42[.]90[.]140
twilio-sso[.]com, rogers-help[.]net, twilio-help[.]com, tmoblle[.]co,
t-moblie[.]help, twlilo[.]net 165[.]227[.]57[.]16 twilio-sso[.]com,
att-sso[.]net 147[.]182[.]201[.]149 coin-base-okta[.]com, rogers-sso[.]com,
concentrlx[.]com, concentrix-sso[.]com 146[.]190[.]42[.]89
teleperformance-sso[.]com, transcom-help[.]com, atento-help[.]com,
sykes-help[.]com, sitel-sso[.]com, mailchimp-help[.]com, sinch-sso[.]com
146[.]190[.]44[.]66 transcom-sso[.]com, hubspot-sso[.]com, mailchimp-sso[.]com,
maiichlmp[.]com 167[.]99[.]221[.]10 att-sso[.]com, sitel-help[.]com,
bandwidth-okta[.]com 147[.]182[.]132[.]52 cloudflare-okta[.]com
167[.]172[.]141[.]4 twilio-okta[.]com, iqor-helpdesk[.]com, ttec-help[.]com
67[.]205[.]146[.]165 vzw-corp[.]net, iqor-help[.]net, metropcs-edge[.]net
143[.]198[.]164[.]89 iqor-tmobile[.]com, iqor-help[.]com 45[.]63[.]79[.]150
sykes-vpn[.]com, startek-vpn[.]com, t-moblie-okta[.]com, att-uid[.]co,
at-uid[.]com, att-ctx[.]com, att-uid[.]co, activecampaign-okta[.]com
144[.]202[.]117[.]57 vzwcorp[.]co 138[.]197[.]7[.]153 tmoblle[.]org,
t-mobiie[.]co 144[.]202[.]17[.]28 att-id[.]net, att-uid[.]net
45[.]76[.]171[.]233 uid-att[.]com, att-uid[.]com, intercom-vpn[.]com,
sutherlandglobal-vpn[.]com, sitel-vpn[.]net 95[.]179[.]238[.]3 t-mobilers[.]com
137[.]184[.]55[.]52 tmoble[.]net, tp-update[.]com 159[.]223[.]160[.]128
tmoblle[.]net 69[.]55[.]49[.]252 teleperformance-usa[.]net, mytpusa[.]net
143[.]198[.]156[.]234 tmobiler[.]net, t-mobile-okta[.]net, t-moblier[.]org,
teleperformance-usa[.]net 159[.]89[.]93[.]54 att-opus[.]net, opus-att[.]com
161[.]35[.]119[.]80 t-mobile-okta[.]org, mytpusa[.]com, twit-vpn[.]com,
epicgames-vpn[.]com 67[.]205[.]151[.]76 att-citrix[.]net, tpusa-citrix[.]com,
att-citrix[.]com 138[.]68[.]27[.]0 okta-hubspot[.]com, mailchimp-okta[.]com,
twitter-okta[.]com, infosys-vpn[.]com, ttec-vpn[.]com, taskus-vpn[.]com
104[.]248[.]234[.]27 tp-usa[.]net, tmoblie[.]net 67[.]205[.]154[.]21
t-mobiie[.]org, t-mobiie[.]net 64[.]227[.]23[.]72 t-mobiie[.]net,
okta-oath[.]com 159[.]89[.]159[.]7 okta-tmobiie[.]net, t-mobile-okta[.]com,
t-mobile-okta[.]us 66[.]175[.]217[.]141 okta-tmo[.]org, okta-tmobile[.]org
172[.]105[.]98[.]36 tmo-okta[.]com, okta.tmobiie[.]net, okta-drop[.]com
138[.]197[.]194[.]87 loginxarth[.]tv 138[.]68[.]26[.]2 binance-okta[.]com,
snap-okta[.]net, snap-okta[.]com, epicgames-okta[.]com, evernote-onelogin[.]com,
riotgames-vpn[.]net, okta-riotgames[.]com, one-login[.]co, cb-okta[.]com,
cb-okta[.]net 149[.]28[.]110[.]16 tmobile-okta[.]com, tmobile-okta[.]net
157[.]245[.]246[.]85 riotgames-okta[.]com, tmobile-okta[.]com,
riotgames-vpn[.]com, customer-internal[.]com 147[.]182[.]218[.]194
alorica-vpn[.]com, concentrixhelp[.]com, att-vmware[.]com 104[.]248[.]236[.]115
att-vpn[.]org, corp-att[.]net, att-vpn[.]com 192[.]241[.]142[.]113
att-support[.]org 165[.]227[.]79[.]161 tmo[.]ac 137[.]184[.]136[.]163
bestbuy-vpn[.]com, ttecvpn[.]com
Share this article
Found it interesting? Don't hesitate to share it to wow your friends or
colleagues
* Twitter
* LinkedIn
* Telegram
*
Rustam Mirkasymov
Head of cyber threat research, Group-IB (Europe)
Roberto Martinez
Sr. Threat Intelligence Analyst, Group-IB (Europe)
More posts
October 5, 2023
Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB
Fraud Matrix
September 26, 2023
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?
September 22, 2023
It’s a trap: Detecting a cryptominer on a popular website using Group-IB MXDR
View all
This site uses cookies
We use cookies on the website to make your browser experience more personal,
convenient and secure. You may block or manage the use of cookies, however, in
some cases they’re essential to make this site work properly. Learn more about
cookies in Group-IB Privacy And Cookies Policy.
Accept Find out more
Products
* Threat Intelligence
* Fraud Protection
* Managed XDR
* Attack Surface Management
* Digital Risk Protection
* Business Email Protection
Solutions
* Ransomware Protection and Response
* Phishing and Scam Protection
* Bot Protection
Services
Pricing
Resources
* Research Hub
* Knowledge Hub
* Certificates
* Webinars
* Blog
Company
* About Group-IB
* CERT-GIB
* Team
* Partners
* MSSP and MDR Partner Program
* Careers
* Internship
* Media Center
* Contact
Subscribe to stay up to date with the latest cyber threat trends
Latest Form Submitted
utm_campaign
utm_content
utm_medium
utm_source
utm_term
Language (Mailing)
Country/Region
* I understand and agree that my personal data will be collected and processed
according to the Privacy and Cookies Policy and unconditionally agree and
accept the Terms of Use
*
Contact
* Asia-Pacific: +65 3159 4398
* Europe and North America: +31 20 226 90 90
* Middle East and Africa: +971 4 568 1785
info@group-ib.com
*
*
*
*
*
*
© 2003 – 2023 Group-IB is a global leader in the fight against cybercrime,
protecting customers around the world by preventing breaches, eliminating fraud
and protecting brands.
* Terms
* Privacy
Subscribe to the latest cyber threat trends!
Latest Form Submitted
utm_campaign
utm_content
utm_medium
utm_source
utm_term
* I understand and agree that my personal data will be collected and processed
according to the Privacy and Cookies Policy and unconditionally agree and
accept the Terms of Use
*