Zamonaviy fishing kampaniyalari an'anaviy ma'lumot o'g'irlashga tayanmasdan Amerika bizneslarini buzishi mumkin. Hujumchilar qonuniy bulut xizmatlari, autentifikatsiya mexanizmlari va ishonchli biznes jarayonlaridan foydalanib, korporativ hisob qaydnomalariga kirishlari mumkin, shu bilan birga kamroq aniq izlar qoldiradilar.
ANY.RUNning Skyw4lker tahlili — bu asosan AQSh tashkilotlarini nishonga olgan qurilma kodi fishing kampaniyasi — amalda bu qanday ishlashini ko'rsatadi. Kampaniya ishlab chiqarish, texnologiya va sog'liqni saqlash sohalariga e'tibor qaratgan, biznes mavzusidagi hujjatlar, Google tomonidan joylashtirilgan infratuzilma va Microsoft autentifikatsiya oqimlaridan foydalanib, hisob qaydnomasini buzishni osonlashtirgan.
Xavfsizlik jamoalari uchun tekshiruv dastlabki jozibani aniqlashdan tashqariga chiqadi. Bu autentifikatsiya oqimi va qo'llab-quvvatlovchi infratuzilmani kuzatish, ishonchli ko'rsatkichlarni ajratib olish va bu topilmalarni kengroq tashkilotni himoya qila oladigan aniqlovlarga aylantirishni talab qiladi.
Qurilma kodi fishingi: AQSh tashkilotlari uchun o'sib borayotgan muammo
AQShda fishingning miqyosi muhim fonni taqdim etadi. FBIning Internet jinoyati shikoyat markazi 2024-yilda 193 407 ta fishing va soxtalashtirish shikoyatini qayd etgan, bu esa internet jinoyatining eng tez-tez xabar qilingan toifalaridan biri bo'lgan. 2025-yilda FBI 1 milliondan ortiq internet jinoyati shikoyatini va 20,9 milliard dollar miqdoridagi xabar qilingan yo'qotishlarni qayd etgan, xabar qilingan yo'qotishlar oldingi yilga nisbatan 26% ga oshgan.
Hujumchilar shuningdek, identifikatsiya xavfsizligi va MFAga katta sarmoya kiritgan tashkilotlarga moslashmoqda.
Qurilma kodi fishingi buning bir misoli. Soxta kirish sahifasi orqali ma'lumotlarni yig'ish o'rniga, hujumchi qonuniy qurilma avtorizatsiya oqimini boshlashi va jabrlanuvchini uni yakunlashga ishontirishi mumkin. Natijada olingan autentifikatsiya tokenlari buzilgan hisob qaydnomasiga tegishli resurslarga kirish huquqini berishi mumkin.
Skyw4lker qonuniy autentifikatsiyadan qanday foydalanib hisob qaydnomalarini buzadi
Skyw4lker kampaniyasi qanday ishlaydi
Skyw4lker ANY.RUNning Interaktiv Sandbox tahlilida kuzatilganidek, oddiy biznes yozishmalariga o'xshash joziba bilan boshlanadi.
ANY.RUNning Interaktiv Sandboxida aniqlangan Skyw4lker fishing to'plami
Jabrlanuvchilar shartnoma yoki xizmat taklifi sifatida taqdim etilgan parol bilan himoyalangan hujjatni oladilar. Bu ssenariy xodimlar muntazam ravishda sotuvchi shartnomalari, xarid hujjatlari, ish bayonotlari va shunga o'xshash fayllarni almashadigan muhitlarda ishonchli ko'rinadi.
Hujjatdan jabrlanuvchi sites[.]google[.]com da joylashtirilgan sahifaga yo'naltiriladi, bu esa oxir-oqibat Microsoft autentifikatsiya oqimiga olib boradi.
Skyw4lker jabrlanuvchilarni Microsoft365 autentifikatsiya sahifasiga yo'naltirmoqda
Hujumchiga Microsoftning kirish tajribasini mukammal tarzda qayta yaratish shart emas. Autentifikatsiyaning o'zi qonuniy bo'lishi mumkin; aldov jabrlanuvchini hujumchi tomonidan boshlatilgan autentifikatsiya so'rovini yakunlashga ishontirishda.
Jarayon yakunlangach, hujumchi natijada olingan Microsoft 365 tokenlariga kirish huquqini olishi mumkin.
Bu hujumni faqat identifikatsiya telemetriyasi orqali baholashni qiyinlashtiradi. Tashkilot darhol zararli kontekstni ko'rmasdan, haqiqiy autentifikatsiya hodisasini ko'rishi mumkin. Nima sodir bo'lganini aniqlash xavfsizlik jamoasidan hujjat, veb-faollik, autentifikatsiya oqimi va bog'liq infratuzilmani bog'lashni talab qiladi.
Skyw4lker fishing sahifasi ortidagi infratuzilma
Skyw4lker tomonidan ishlatilgan veb-infratuzilma kampaniyaning ishlashiga qo'shimcha dalil beradi.
ANY.RUN tahlili jabrlanuvchi sessiyasini yaratish, IP manzil va geolokatsiya kabi ma'lumotlarni yig'ish va autentifikatsiya jarayoni yakunlanishini kutish davomida orqa fon bilan qayta-qayta so'rov yuborish uchun ishlatiladigan xiralashtirilgan JavaScript va PHP orqa fonini aniqladi.
ANY.RUNning Interaktiv Sandboxida mamlakat bo'yicha Skyw4lker namuna yuborishlari
Asl hujjatning statik tekshiruvi boshlang'ich URLni ochib berishi mumkin, ammo jabrlanuvchi sahifa bilan o'zaro aloqada bo'lgach nima sodir bo'lishini to'liq tushuntira olmaydi. Zararli xatti-harakatlar brauzer faolligi, JavaScript bajarilishi, orqa fon aloqasi, yo'naltirishlar va autentifikatsiya kombinatsiyasi orqali paydo bo'ladi.
Bu xatti-harakat tahlilini muhim qiladi, chunki maqsad fishing kampaniyasi aynan nima qilayotganini va keyingi aniqlash uchun qaysi ko'rsatkichlarga ishonish mumkinligini aniqlashdir.
Skyw4lker tahlilini ANY.RUNning Interaktiv Sandboxida ko'ring, uning to'liq hujum zanjiri va bog'liq IOClarini ko'rish uchun.
Tier 1 ish yukini 20% gacha kamaytiring va tahlilchilarga muhim tahdidlarga e'tibor qaratish uchun ko'proq vaqt bering.
SOC samaradorligini oshiring
Interaktiv Sandbox shubhali fayl va URLlarni amaliy dalillarga aylantiradi
Interaktiv sandbox xavfsizlik jamoalariga shubhali fayllar, havolalar va hujjatlarni xavfsiz bajarish va ular bilan o'zaro aloqada bo'lish imkonini beradi, bu esa statik tekshiruv o'tkazib yuboradigan xatti-harakatni ochib beradi.
Bu Skyw4lker kabi kampaniyalarda muhim, chunki hujjat faqat boshlang'ich nuqta. Tahlilchilar hujumni brauzer orqali kuzatishlari, yo'naltirishlar va autentifikatsiya faolligini kuzatishlari, tarmoq aloqasini tekshirishlari va fishing oqimi ortidagi infratuzilmani aniqlashlari kerak. Bularning barchasi izolyatsiya qilingan ANY.RUN Sandbox muhitida amalga oshirilishi mumkin, natija esa 40 soniyada tayyor bo'lishi mumkin.
Kuzatilgan Skyw4lker namunasi uchun ANY.RUN sandboxida mavjud Tier 1 hisoboti
Zararli/yaxshi hukmda to'xtash o'rniga, tekshiruv URLlar, domenlar, IP manzillar, tarmoq faolligi, skrinshotlar, xatti-harakat dalillari va boshqa IOClarni ishlab chiqarishi mumkin. Bu topilmalar xavfsizlik jamoalariga ogohlantirishni tasdiqlash, bog'liq faollikni qamrab olish va bitta tekshiruv davomida to'plangan dalillar asosida aniqlovlar yaratish uchun zarur kontekstni beradi.
Natijada, SOC va MSSP jamoalari hujumni bir nechta vositalar bo'yicha qo'lda qayta yaratmasdan tezroq ishonchli hukmga erishishi mumkin, natijada olingan razvedka esa kengroq muhitda tahdid ovlash va aniqlashni qo'llab-quvvatlashi mumkin. Bundan tashqari, xuddi shu ish jarayoni MSSPlarga yangi kampaniyalarni tekshirish va bitta mijoz holatidan olingan topilmalarni boshqa muhitlarda qidirish mumkin bo'lgan razvedkaga aylantirishni osonlashtiradi.
Tahdid razvedkasini erta aniqlashga aylantirish
IOCning qiymati u boshqa hujumni aniqlash uchun ishlatilishi mumkin bo'lganda oshadi.
ANY.RUN Tahdid Razvedkasi Oqimlari (TI Feeds) sandbox tekshiruvlaridan olingan zararli IPlar, domenlar, URLlar va kontekstual ma'lumotlarni taqdim etadi. 99% noyob, yuqori ishonchli IOClar tasdiqlangandan so'ng TI Feedsga qo'shiladi, bu esa xavfsizlik jamoalariga allaqachon ko'rib chiqilgan razvedka bilan ishlashga yordam beradi.
ANY.RUN TI Feeds real vaqtda hujum aniqlash uchun jonli tahdid razvedkasini taqdim etadi
ANY.RUNning ichki tahlili shuni ko'rsatdiki, Interaktiv Sandbox sessiyalarida aniqlangan noyob zararli IOClarning 30% gacha qismi allaqachon kompaniya tomonidan kuzatilgan va TI Feedsda mavjud bo'lgan. Bu ko'rsatkichlardan biri mijoz telemetriyasida paydo bo'lganda, u tahlilchi bog'liq namunani qo'lda tekshirishdan oldin mavjud razvedka bilan moslashtirilishi mumkin.
Bu yanada samarali ish jarayonini yaratadi: ma'lum zararli faollik erta aniqlanishi mumkin, sandbox tahlili esa notanish tahdidlarni tekshirish uchun zarur xatti-harakat dalillarini taqdim etadi.
Ichki SOClar uchun bu allaqachon zararli ekanligi ma'lum bo'lgan ko'rsatkichlarni tadqiq qilishga sarflanadigan vaqtni kamaytirishi mumkin. MSSPlar uchun xuddi shu razvedka bir nechta mijoz muhitlarida bog'liq faollikni aniqlashga yordam berishi mumkin. Bu mavjud tahdid bilimini har bir yangi ogohlantirish uchun qayta qurish o'rniga qayta ishlatish usulidir.
MTTRni 21 daqiqaga qisqartiring va SOCingizga muhim tahdidlarga e'tibor qaratish uchun ko'proq vaqt bering.
TI Feedsni integratsiya qiling
Tahdid razvedkasi ogohlantirish ortidagi kontekstni taqdim etadi
Ko'rsatkich xavfsizlik jamoalari uni o'rab turgan faollikni tushunishi mumkin bo'lganda yanada foydali bo'ladi.
ANY.RUNning Tahdid Razvedkasi Qidiruvi (TI Lookup) tahlilchilarga shubhali domen, IP manzil yoki URLni tekshirish va uning tarixi va bog'liq faolligini ko'rib chiqish imkonini beradi. Skyw4lker bilan bog'liq tekshiruvda bu kontekst ko'rsatkich kampaniya bilan bog'liqmi, boshqa zararli faollikda paydo bo'lganmi yoki qo'shimcha tekshiruvni talab qiladimi, aniqlashga yordam berishi mumkin.
Bundan tashqari, ANY.RUNning Tahdid Razvedkasi Hisobotlari (TI Reports) ko'rsatkichlarni kampaniyalar, infratuzilma, texnikalar va kuzatilgan xatti-harakat bilan bog'lash orqali kengroq nuqtai nazarni taqdim etadi. Bu alohida ogohlantirishlardan ko'rish qiyin bo'lgan munosabatlarni ochib berishi mumkin, masalan, bir nechta hodisalar bir xil infratuzilmani ulashishi yoki shubhali domen kengroq fishing operatsiyasiga tegishli bo'lishi.
AQSh sog'liqni saqlash, ishlab chiqarish va texnologiya sohalaridagi tashkilotlar haqida gap ketganda, bu bog'lanishlar ayniqsa muhim bo'lishi mumkin. Buzilgan Microsoft 365 hisob qaydnomasi sezgir aloqalarni, intellektual mulkni, operatsion ma'lumotlarni va tartibga solinadigan ma'lumotlarni ochib berishi mumkin, bu esa bog'liq faollikni erta aniqlashni muhim qiladi.
Har bir SOC va MSSP tekshiruvini yanada qimmatli qilish
Muvaffaqiyatli tekshiruv tashkilotning keyingi hujumni aniqlash qobiliyatini yaxshilashi kerak.
Bir Amerika ishlab chiqarish mijoziga yuborilgan shubhali shartnomani tekshirayotgan MSSP uchun Skyw4lker bilan bog'liq ko'rsatkichlar boshqa mijoz muhitlarida qidirilishi va monitoringga kiritilishi mumkin. Xuddi shu yondashuv ichki SOC muhitida ham ishlaydi, bu yerda bitta xodim fishing hujjatini xabar qilgandan so'ng topilgan IOC tarixiy telemetriya bilan solishtirilishi mumkin, bu esa boshqa potentsial ta'sirlangan foydalanuvchilarni aniqlashga yordam beradi.
ANY.RUN bu ish jarayonlarini API/SDK, STIX/TAXII, SIEM, TIP va XDR integratsiyalari orqali qo'llab-quvvatlaydi, bu esa tekshiruvlardan olingan razvedkaning mavjud aniqlash va monitoring jarayonlariga kirishiga imkon beradi.
Natija bitta tekshiruvdan kengroq himoya: bitta foydalanuvchiga ta'sir qilgan hodisa SOC yoki MSSPning kengroq mijoz bazasi bo'ylab bog'liq faollikni aniqlashga yordam beradigan razvedka yaratishi mumkin.
58% gacha ko'proq tahdidni oching va paydo bo'layotgan hujumlarga kengroq ko'rinishga ega bo'ling.
Tahdid aniqlashni kuchaytiring
Xulosa
Skyw4lker zamonaviy fishing himoyasi dastlabki joziba yoki kirish sahifasidan tashqari ko'rinishni talab qilishini ko'rsatadi. Interaktiv sandboxing, tahdid razvedkasi va kontekstual tekshiruvni birlashtirish orqali xavfsizlik jamoalari shubhali artefaktdan amaliy razvedkaga va kengroq aniqlashga tezroq o'tishlari mumkin.
AQShdagi tashkilotlar uchun bu tezroq tekshiruvlar, kamroq takroriy qo'lda ish va u kattaroq hodisaga aylanishidan oldin bog'liq faollikni aniqlashning yaxshiroq qobiliyatini anglatadi. Maqsad faqat bitta hujumni tushunish emas, balki har bir tekshiruvni keyingi hujumga qarshi himoyaga aylantirishdir.
Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind.
ANY.RUN's analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations, shows how this works in practice. The campaign has focused on manufacturing, technology, and healthcare, using business-themed documents, Google-hosted infrastructure, and Microsoft authentication flows to facilitate account compromise.
For security teams, the investigation goes beyond identifying the initial lure. It requires tracing the authentication flow and supporting infrastructure, extracting reliable indicators, and turning those findings into detections that can protect the wider organization.
Device Code Phishing: A Growing Challenge for U.S. Organizations
The scale of phishing in the United States provides an important backdrop. The FBI's Internet Crime Complaint Center recorded 193,407 phishing and spoofing complaints in 2024, making it one of the most frequently reported categories of internet crime. In 2025, the FBI recorded more than 1 million internet crime complaints and $20.9 billion in reported losses, with reported losses increasing by 26% compared with the previous year.
Attackers are also adapting to organizations that have invested heavily in identity security and MFA.
Device code phishing is one example. Rather than collecting credentials through a fake login page, an attacker can initiate a legitimate device authorization flow and convince the victim to complete it. The resulting authentication tokens can then provide access to resources available to the compromised account.
How Skyw4lker Uses Legitimate Authentication to Compromise Accounts
How the Skyw4lker Campaign Works
Skyw4lker starts with a lure designed to resemble normal business correspondence, as observed in ANY.RUN’s Interactive Sandbox analysis.
The Skyw4lker phishing kit identified in ANY.RUN’s Interactive Sandbox
Victims receive a password-protected document presented as a contract or service proposal. The scenario is credible in environments where employees routinely exchange vendor agreements, procurement documents, statements of work, and similar files.
From the document, the victim is directed toward a page hosted on sites[.]google[.]com, which eventually leads into a Microsoft authentication flow.
Skyw4lker redirecting the victims to a Microsoft365 authentication page
The attacker does not need to reproduce Microsoft's login experience perfectly. The authentication itself can be legitimate; the deception is in convincing the victim to complete an authentication request initiated by the attacker.
Once the process is completed, the attacker can obtain access to the resulting Microsoft 365 tokens.
That makes the attack difficult to evaluate through identity telemetry alone. An organization may see a valid authentication event without immediately seeing the malicious context that caused it. Establishing what happened requires the security team to connect the document, web activity, authentication flow, and associated infrastructure.
The Infrastructure Behind the Skyw4lker Phishing Page
The web infrastructure used by Skyw4lker provides additional evidence of the campaign's operation.
ANY.RUN’s analysis identified obfuscated JavaScript and a PHP backend used to create a victim session, collect information such as IP address and geolocation, and repeatedly poll the backend while waiting for the authentication process to complete.
Skyw4lker sample submissions in ANY.RUN’s Interactive Sandbox by country
A static inspection of the original document may reveal the starting URL, but it cannot fully explain what happens once the victim interacts with the page. The malicious behavior emerges through the combination of browser activity, JavaScript execution, backend communication, redirects, and authentication.
That makes behavioral analysis essential when the objective is to establish exactly what a phishing campaign is doing and which indicators can be trusted for follow-up detection.
View the Skyw4lker analysis in ANY.RUN’s Interactive Sandbox to see its complete attack chain and associated IOCs.
Reduce Tier 1 workload by up to 20% and give analysts more time to focus on critical threats.
Boost Your SOC Efficiency
Interactive Sandboxing Turns Suspicious Files and URLs into Actionable Evidence
An interactive sandbox lets security teams safely execute and interact with suspicious files, links, and documents, revealing behavior that static inspection can miss.
That matters in campaigns such as Skyw4lker, where the document is only the starting point. Analysts need to follow the attack through the browser, observe redirects and authentication activity, inspect network communication, and identify the infrastructure behind the phishing flow. All of this can be done in an isolated ANY.RUN Sandbox environment, with a result available in as little as 40 seconds.
The Tier 1 report for the observed Skyw4lker sample available in ANY.RUN’s sandbox
Instead of stopping at a malicious/benign verdict, the investigation can produce URLs, domains, IP addresses, network activity, screenshots, behavioral evidence, and other IOCs. These findings give security teams the context needed to validate an alert, scope-related activity, and create detections from evidence gathered during a single investigation.
As a result, SOC and MSSP teams can reach a confident verdict faster without manually reproducing the attack across multiple tools, while the resulting intelligence can support threat hunting and detection across the wider environment. Moreover, the same workflow makes it easier for MSSPs to investigate new campaigns and turn findings from one customer case into intelligence that can be searched across other environments.
Turning Threat Intel into Earlier Detection
The value of an IOC increases when it can be used to detect another attack.
ANY.RUN Threat Intelligence Feeds (TI Feeds) provide malicious IPs, domains, URLs, and contextual information derived from sandbox investigations. 99% of unique, high-confidence IOCs are added to TI Feeds after validation, helping security teams work with intelligence that has already been reviewed.
ANY.RUN TI Feeds provide live threat intelligence for real-time attack detection
ANY.RUN’s internal analysis found that up to 30% of unique malicious IOCs discovered in Interactive Sandbox sessions had already been observed by the company and were present in TI Feeds. When one of these indicators appears in customer telemetry, it can potentially be matched against existing intelligence before an analyst manually investigates the associated sample.
This creates a more efficient workflow: known malicious activity can be identified earlier, while sandbox analysis provides the behavioral evidence needed to investigate unfamiliar threats.
For internal SOCs, this can reduce time spent researching indicators that are already known to be malicious. For MSSPs, the same intelligence can help identify related activity across multiple customer environments. This is how the existing threat knowledge can be reused instead of reconstructed for every new alert.
Cut MTTR by 21 minutes and give your SOC more time to focus on critical threats.
Integrate TI Feeds
Threat Intelligence Provides Context Behind the Alert
An indicator becomes more useful when security teams can understand the activity surrounding it.
ANY.RUN’s Threat Intelligence Lookup (TI Lookup) allows analysts to investigate a suspicious domain, IP address, or URL and examine its history and associated activity. In a Skyw4lker-related investigation, this context can help determine whether an indicator is connected to the campaign, has appeared in other malicious activity, or requires further investigation.
In addition, ANY.RUN’s Threat Intelligence Reports (TI Reports) provide a broader perspective by connecting indicators with campaigns, infrastructure, techniques, and observed behavior. This can reveal relationships that are difficult to see from individual alerts, such as multiple incidents sharing the same infrastructure or a suspicious domain belonging to a wider phishing operation.
When it comes to organizations in U.S. healthcare, manufacturing, and technology, those connections can be especially important. A compromised Microsoft 365 account can expose sensitive communications, intellectual property, operational information, and regulated data, making early identification of related activity critical.
How to Make Each SOC and MSSP Investigation More Valuable
A successful investigation should improve an organization's ability to detect the next attack.
For an MSSP investigating a suspicious contract sent to one American manufacturing customer, indicators associated with Skyw4lker can be searched across other customer environments and incorporated into monitoring. The same approach works within an internal SOC environment, where an IOC found after one employee reports a phishing document can be compared against historical telemetry to identify other potentially affected users.
ANY.RUN supports these workflows through API/SDK, STIX/TAXII, SIEM, TIP, and XDR integrations, allowing intelligence from investigations to feed into existing detection and monitoring processes.
The result is broader protection from the same investigation: an incident affecting one user can generate intelligence that helps identify related activity across a SOC or MSSP's wider customer base.
Uncover up to 58% more threats and gain broader visibility into emerging attacks.
Boost Threat Detection
Conclusion
Skyw4lker shows why modern phishing defense requires visibility beyond the initial lure or login page. By combining interactive sandboxing, threat intelligence, and contextual investigation, security teams can move faster from suspicious artifact to actionable intelligence and broader detection.
For organizations in the U.S., that means faster investigations, less repetitive manual work, and a better ability to identify related activity before it becomes a larger incident. The goal is not only to understand one attack, but to turn every investigation into protection against the next one.
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.