SC-063: AI-Generated Phishing Campaign¶

# SILKTHREAD reconnaissance pipeline (reconstructed from seized infrastructure)
# Automated OSINT collection and analysis

# Step 1: Target organization profiling
# Tool: LURESMITH Recon Module (custom Python/LLM pipeline)

luresmith recon --target "Meridian Financial Group" \
  --sources linkedin,sec_edgar,press_releases,youtube,podcasts \
  --output profiles/meridian_financial/

# Output: Organization profile
# {
#   "company": "Meridian Financial Group",
#   "sector": "Financial Services — Investment Management",
#   "employees": 2400,
#   "revenue": "$3.2B AUM",
#   "email_domain": "meridian-financial.example.com",
#   "email_format": "first.last@meridian-financial.example.com",
#   "sso_provider": "Microsoft Entra ID (Azure AD)",
#   "leadership": [
#     {
#       "name": "Robert Harrington",
#       "title": "CEO",
#       "email": "robert.harrington@meridian-financial.example.com",
#       "linkedin": "linkedin.com/in/robert-harrington-SYNTHETIC",
#       "voice_samples": ["Q3_2025_earnings_call.mp3 (47:23)"],
#       "communication_style": "formal, decisive, uses 'let me be direct'",
#       "recent_topics": ["Q3 earnings beat", "Southeast Asia expansion",
#                         "upcoming acquisition strategy"]
#     },
#     {
#       "name": "Maria Chen",
#       "title": "CFO",
#       "email": "maria.chen@meridian-financial.example.com",
#       "reports_to": "Robert Harrington",
#       "approval_authority": "$5M single-signature wire transfers"
#     },
#     {
#       "name": "David Park",
#       "title": "VP Finance",
#       "email": "david.park@meridian-financial.example.com",
#       "reports_to": "Maria Chen",
#       "approval_authority": "$2M single-signature wire transfers"
#     }
#   ]
# }

# Voice cloning pipeline (SILKTHREAD's internal tooling)
# Based on open-source voice synthesis models, fine-tuned for cloning

# Step 1: Audio extraction from earnings call recording
# Source: Q3 2025 earnings call (publicly available webcast)
# Duration: 47:23 (CEO speaking portions: ~22 minutes after isolation)

luresmith voice-clone \
  --source earnings_call_q3_2025.mp3 \
  --speaker-id "robert_harrington" \
  --isolate-speaker true \
  --model "voice-synth-v3" \
  --output models/harrington_voice_v1.model

# Training metrics:
# Speaker isolation: 98.7% accuracy (removed analysts, CFO segments)
# Voice clone MOS (Mean Opinion Score): 4.2/5.0
# Pronunciation accuracy: 96.3%
# Emotional range: neutral, confident, urgent (trained separately)
# Prosody match: 94.1% (speech rhythm, intonation patterns)

# Step 2: Voice clone validation
luresmith voice-test \
  --model models/harrington_voice_v1.model \
  --text "Maria, this is Robert. I need to discuss something confidential
          with you regarding an acquisition we're finalizing. Can you make
          sure this stays between us for now?" \
  --emotion confident \
  --output test_samples/harrington_test_01.wav

# Quality assessment: 4.3/5.0 MOS
# Notable artifacts: slight unnatural pause before proper nouns (addressed in v1.1)
# Phone line simulation: applied 8kHz bandpass filter to mask remaining artifacts
# Result: Indistinguishable from real CEO voice over phone connection

# Step 3: Real-time voice synthesis configuration
# SILKTHREAD operates voice calls through a real-time synthesis bridge
# Operator types/speaks in native language → AI converts to target voice

luresmith voice-bridge \
  --model models/harrington_voice_v1.model \
  --input-mode text-to-speech \
  --latency-target 200ms \
  --phone-simulation true \
  --caller-id "+1-555-0147"    ← Spoofed to match CEO's known number
  --recording true \
  --output calls/

# LURESMITH email generation (AI phishing engine)
# Each email is uniquely generated — no templates, no reuse

# Email generation for credential harvesting (Wave 1)
luresmith generate-email \
  --campaign "meridian_cred_harvest" \
  --sender-persona "IT Security Team" \
  --targets targets/meridian_wave1.json \
  --pretext "mandatory_security_review" \
  --landing-page "https://sso.meridian-financial-group.example.com/verify" \
  --evasion-mode aggressive \
  --output emails/wave1/

# Example generated email (for target: sarah.kim@meridian-financial.example.com)
# ──────────────────────────────────────────────────────────────────
# From: security-team@meridian-financial.example.com (spoofed)
# To: sarah.kim@meridian-financial.example.com
# Subject: Action Required: Annual Security Credential Verification
#
# Hi Sarah,
#
# As part of Meridian Financial Group's annual security compliance
# review (per our updated SOC 2 Type II requirements), all finance
# team members are required to verify their credentials through our
# updated authentication portal by end of business Friday.
#
# This specifically applies to your role as Senior Accountant, as
# your access to the wire transfer approval system (FinanceConnect)
# requires enhanced verification this quarter.
#
# Please complete your verification here:
# https://sso.meridian-financial-group.example.com/verify
#
# If you've already completed this for Q1, please disregard.
#
# Thanks,
# Meridian IT Security Team
# ──────────────────────────────────────────────────────────────────

# Note: AI-generated elements:
# 1. Personalized to target's name and role ("Senior Accountant")
# 2. References real internal system ("FinanceConnect") learned from LinkedIn
# 3. Cites real compliance framework (SOC 2 Type II) relevant to finance
# 4. Provides opt-out to reduce suspicion ("If you've already completed...")
# 5. No grammatical errors, natural tone, appropriate formality level

# Adversarial evasion techniques applied by LURESMITH:
# - Unicode homoglyphs in key detection-triggering words
# - Invisible zero-width characters to break signature matching
# - Base domain looks legitimate with proper SPF/DKIM/DMARC
# - HTML email with invisible text to confuse ML classifiers
# - Randomized sentence structure to avoid n-gram detection

# Real-time phishing proxy for MFA bypass
# SILKTHREAD deploys adversary-in-the-middle (AitM) proxy

# Phishing landing page: sso.meridian-financial-group.example.com
# Proxied to: login.microsoftonline.com (real Microsoft login)
# Tool: Custom fork of open-source AitM framework

# Attack flow:
# 1. Victim clicks link → arrives at attacker-controlled SSO page
# 2. Victim enters username/password → relayed to real Microsoft login
# 3. Microsoft sends MFA push → victim approves on their phone
# 4. Session token captured by proxy before reaching victim's browser
# 5. Attacker uses stolen session token to access victim's mailbox

# Credential capture log (from attacker infrastructure):
[2026-01-15 08:45:12 UTC] CAPTURE: sarah.kim@meridian-financial.example.com
  Password: S@r@hK!m_MFG2025 (synthetic)
  MFA: Approved (Microsoft Authenticator push)
  Session Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJS...REDACTED
  Access: Outlook, SharePoint, OneDrive

[2026-01-15 08:52:33 UTC] CAPTURE: d.nguyen@meridian-financial.example.com
  Password: Davi3_Nguyen! (synthetic)
  MFA: Approved (SMS code: 847291)
  Session Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJS...REDACTED

[2026-01-15 09:01:45 UTC] CAPTURE: j.wilson@meridian-financial.example.com
  Password: JW!ls0n_2025 (synthetic)
  MFA: Approved (Microsoft Authenticator push)
  Session Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJS...REDACTED

[2026-01-15 09:15:02 UTC] CAPTURE: m.rodriguez@meridian-financial.example.com
  Password: M@ri@R0d_MFG (synthetic)
  MFA: Approved (Microsoft Authenticator push)
  Session Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJS...REDACTED

# Total: 4 of 12 targets compromised (33% success rate)
# All 4 had MFA enabled — bypassed via real-time session token theft

# Mailbox reconnaissance using stolen session tokens
# SILKTHREAD accesses victim mailboxes to map finance workflows

# Target: sarah.kim@meridian-financial.example.com (Senior Accountant)
# Access method: Stolen OAuth session token via Microsoft Graph API

# Graph API queries (from attacker logs):
GET https://graph.microsoft.com/v1.0/me/messages?
  $filter=contains(subject,'wire transfer') or
          contains(subject,'payment') or
          contains(subject,'approval')
  &$top=50
  &$select=subject,from,toRecipients,body,sentDateTime

# Intelligence gathered from mailbox analysis:
# 1. Wire transfer approval process:
#    - Requests initiated via email to wire-approvals@meridian-financial.example.com
#    - Single signature required for transfers under $5M (CFO authority)
#    - Dual signature required for transfers $5M-$25M
#    - Standard format: PDF with bank details, amount, purpose, account reference
#
# 2. Recent wire transfers (pattern analysis):
#    - Average 3-5 wire transfers per week
#    - Typical amounts: $500K - $3M
#    - Common purposes: "Investment acquisition," "Fund transfer," "Vendor payment"
#    - PDF attachments always use Meridian letterhead template
#
# 3. CEO communication patterns:
#    - CEO emails CFO directly for urgent matters
#    - Uses phrases: "Let me be direct," "This needs to move quickly,"
#      "Keep this close hold for now"
#    - Often follows up email with phone call for sensitive topics
#    - Doesn't CC others on confidential acquisition discussions

# SILKTHREAD used this intelligence to craft the CEO impersonation campaign

# Deepfake voice call to CFO Maria Chen
# Real-time voice synthesis via LURESMITH Voice Bridge

# Call metadata:
# Date: 2026-01-16 09:00:00 UTC
# From: +1-555-0147 (spoofed — matches CEO Robert Harrington's known number)
# To: +1-555-0234 (CFO Maria Chen mobile)
# Duration: 4:37
# Voice model: harrington_voice_v1.1

# Call transcript (reconstructed from recording on attacker infrastructure):
# ──────────────────────────────────────────────────────────────────
# [Phone rings]
# CHEN: "Maria Chen."
# AI-HARRINGTON: "Maria, it's Robert. Do you have a minute? I need to
#   discuss something confidential."
# CHEN: "Of course, Robert. What's going on?"
# AI-HARRINGTON: "Let me be direct. We're finalizing the acquisition of
#   Pinnacle Asset Management — the Southeast Asia fund I mentioned at
#   the board meeting last month. The deal is closing this week, and I
#   need you to handle the escrow funding personally."
# CHEN: "I remember the discussion. What are we looking at?"
# AI-HARRINGTON: "The initial escrow is one point eight million. I'm
#   going to send you the wire details by email right after this call.
#   I need this processed today — the seller has a hard deadline, and
#   if we miss it, we lose our exclusivity window."
# CHEN: "One point eight to escrow... let me pull up the approval—"
# AI-HARRINGTON: "Maria, I've already spoken with the board about this.
#   It's approved at the executive level. I just need you to execute the
#   wire. And please keep this close hold for now — we haven't announced
#   publicly yet, and I don't want any leaks before the 8-K filing."
# CHEN: "Understood. I'll watch for your email."
# AI-HARRINGTON: "Thank you, Maria. I'll be in meetings the rest of
#   the day, so if you have questions, email me directly."
# [Call ends]
# ──────────────────────────────────────────────────────────────────

# Note: AI-generated speech included CEO's characteristic phrases
# ("Let me be direct," "close hold"), natural conversation pacing,
# and appropriate emotional tone (confident, slightly urgent).
# Phone line quality masking (8kHz filter) eliminated synthesis artifacts.

# Follow-up email (AI-generated, sent from spoofed address):
# From: robert.harrington@meridian-financial-group.example.com (typosquat)
# To: maria.chen@meridian-financial.example.com
# Subject: RE: Pinnacle Asset Management — Escrow Wire Details
#
# Maria,
#
# As discussed, please process the following wire transfer today:
#
# Beneficiary: Pinnacle Acquisition Holdings LLC
# Bank: First National Bank of Commerce
# Account: 7834-XXXX-XXXX-5291 (REDACTED — synthetic)
# Routing: 0219-XXXXX (REDACTED — synthetic)
# Amount: $1,800,000.00
# Reference: MFG-ACQ-2026-PINNACLE-ESC1
#
# This is the first of three escrow installments. I'll provide details
# on the remaining two next week.
#
# Keep this confidential until we file the 8-K.
#
# —Robert

# CFO processed the wire at 11:00 UTC
# No additional verification performed — CEO voice confirmation was trusted

# Second deepfake call (2026-01-17) — targeting VP Finance David Park
# SILKTHREAD escalated after successful first wire

# Call transcript excerpt:
# AI-HARRINGTON: "David, Robert Harrington here. Maria is handling
#   the primary escrow for the Pinnacle acquisition, but I need you
#   to process an additional funding tranche — one point five million
#   to a separate escrow account. The seller's counsel requires funds
#   in segregated accounts."
# PARK: "I see. Should I coordinate with Maria on this?"
# AI-HARRINGTON: "No — Maria's handling her portion separately. I need
#   these processed independently for regulatory reasons. I'll send
#   you the wire details now."
# PARK: "Understood, I'll take care of it."

# Wire Transfer 2: $1,500,000 to second attacker-controlled account
# Processed: 2026-01-17 14:30:00 UTC

# Third deepfake call (2026-01-18) — targeting Senior Accountant Sarah Kim
# AI-HARRINGTON: "Sarah, this is Robert. I know this is unusual for me
#   to call you directly, but Maria and David are both traveling today
#   and I need a final closing payment processed for the Pinnacle deal.
#   Nine hundred thousand to the escrow agent. Maria already approved
#   this — you can confirm with her when she's back, but I need it
#   done by noon."

# Wire Transfer 3: $900,000 to third attacker-controlled account
# Processed: 2026-01-18 10:00:00 UTC

# Total fraudulent transfers: $4,200,000
# Accounts used (all synthetic):
# Account 1: First National Bank of Commerce — $1,800,000
# Account 2: Pacific Commerce Bank — $1,500,000
# Account 3: Atlantic Trust Bank — $900,000
# Funds immediately cascaded through 7 intermediary accounts
# across 3 jurisdictions before conversion to cryptocurrency

# LURESMITH adversarial evasion techniques
# Designed to bypass Microsoft Defender for Office 365 and third-party SEGs

# Technique 1: Semantic padding with invisible content
# Insert zero-width Unicode characters to break ML tokenization
# Example: "wire tr\u200Bansfer" → displays as "wire transfer" but
# breaks n-gram detection that looks for the exact string

# Technique 2: Context poisoning
# Include hidden HTML text (white-on-white) with benign content
# to shift ML classifier confidence score below detection threshold
# <span style="color:white;font-size:1px">Meeting notes from Q3 review.
# Please find attached the quarterly revenue summary and projections
# for the Southeast Asia expansion initiative...</span>

# Technique 3: Domain reputation building
# meridian-financial-group.example.com was registered 30 days prior
# Legitimate-appearing website deployed with SSL certificate
# SPF, DKIM, and DMARC configured correctly
# Sent benign emails for 2 weeks to build positive reputation score

# Technique 4: Payload-less initial contact
# First email contains no links or attachments — pure text
# Establishes conversation thread before introducing malicious elements
# Bypasses sandboxing and URL/attachment scanning

# Technique 5: LLM-generated unique content
# Every email is uniquely generated — no two emails share identical phrasing
# Defeats signature-based detection and template matching
# Writing style matched to sender persona using fine-tuned model

# LURESMITH evasion metrics (from attacker dashboard):
# Emails sent: 12
# Delivered to inbox (bypassed all filters): 11 (91.7%)
# Quarantined by email security: 1 (8.3%)
# Flagged as suspicious by recipient: 0 (0%)
# Clicked phishing link: 5 (45.5% of delivered)
# Entered credentials: 4 (36.4% of delivered)

index=email sourcetype=exchange_message_tracking
| eval sender_domain=mvindex(split(sender, "@"), -1)
| eval legitimate_domain="meridian-financial.example.com"
| where sender_domain!=legitimate_domain
| eval levenshtein_dist=levenshtein(sender_domain, legitimate_domain)
| where levenshtein_dist > 0 AND levenshtein_dist <= 3
| stats count by sender, sender_domain, recipient, subject, _time
| eval alert_severity="Critical"
| table _time, sender, sender_domain, recipient, subject,
        levenshtein_dist, alert_severity

index=azure sourcetype=azure_audit_log
| where Operation IN ("MailItemsAccessed", "SearchQueryInitiatedExchange")
| where ClientAppId!="known_internal_app_id"
| stats count AS access_count,
        dc(MailboxOwnerUPN) AS mailboxes_accessed,
        values(Operation) AS operations,
        values(ClientIPAddress) AS source_ips
        by UserId, ClientAppId, _time span=1h
| where access_count > 50 OR mailboxes_accessed > 1
| eval alert_severity=case(
    mailboxes_accessed > 3, "Critical",
    access_count > 200, "Critical",
    access_count > 100, "High",
    true(), "Medium")
| table _time, UserId, ClientAppId, access_count,
        mailboxes_accessed, source_ips, alert_severity

index=finance sourcetype=wire_transfers
| where beneficiary_days_known < 30 OR beneficiary_type="NEW"
| where amount > 500000
| join type=left approver_email [
    search index=email sourcetype=exchange_message_tracking
    | where subject="*wire*" OR subject="*transfer*" OR subject="*escrow*"
    | eval approver_email=recipient
    | stats latest(_time) AS email_time,
            values(sender) AS request_sender,
            values(sender_domain) AS sender_domain
            by approver_email
]
| eval time_from_email=_time - email_time
| where time_from_email > 0 AND time_from_email < 14400
| eval domain_match=if(sender_domain=legitimate_domain, 1, 0)
| where domain_match=0
| eval alert_severity="Critical"
| table _time, approver_email, amount, beneficiary_name,
        request_sender, sender_domain, time_from_email, alert_severity