SVB Collapse Becomes a Phishing Lure

The rapid collapse and federal takeover of Silicon Valley Bank (SVB) created widespread uncertainty for businesses. For threat actors, it also created a prime opportunity. Scammers routinely exploit high-profile news events to lend legitimacy to their lures, and the SVB story is no exception. Even with the FDIC guaranteeing depositors' funds, bad actors are already attempting to steal that money via SVB-branded phishing campaigns.

Cloudflare's threat operations team, Cloudforce One, ramped up brand monitoring for SVB on March 10, 2023, and deployed additional detection modules specifically designed to flag SVB-themed phishing attempts. These protections are automatically active for customers using Cloudflare's phishing protection services.

DocuSign-Themed KYC Attack

On March 14, 2023, Cloudflare observed a large-scale phishing campaign abusing the SVB brand through a DocuSign-themed template. The campaign targeted Cloudflare and a wide range of other organizations across multiple industry verticals. Within the first few hours, Cloudflare detected 79 separate examples targeting different individuals. The attack exploited the common "Know Your Customer" (KYC) process that banks use to verify client details, a tactic frequently used by scammers to make fraudulent requests appear routine.

One notable example targeted Cloudflare's CEO, Matthew Prince. The attack began with a simple HTML link labeled "Review Documents," which initiated a four-deep redirect chain:

  • The initial click routed the victim to a tracking link operated by Sizmek at bs[.]serving-sys[.]com.
  • That link redirected to a Google Firebase application hosted at na2signing[.]web[.]app.
  • The Firebase HTML then forwarded the user to a WordPress site, eaglelodgealaska[.]com, which operated as another redirector.
  • Finally, the user landed on a malicious attacker-controlled website at docusigning[.]kirklandellis[.]net.

The WordPress instance used in the redirect chain featured recursive redirection capabilities. It is unclear whether the site was compromised or if a plugin was installed specifically to facilitate the redirect.

Organizations should take proactive steps to protect against SVB-themed fraud and similar campaigns:

  1. Cloudflare Email Security customers can search their dashboards for the hash SH_6a73a08e46058f0ff78784f63927446d875e7e045ef46a3cb7fc00eb8840f6f0 to identify this particular campaign, and can track updated indicators of compromise via the Threat Indicators API.
  2. Enforce DMARC policies on inbound email. Cloudflare recommends a minimum policy of [p = quarantine]. SVB's published DMARC record (v=DMARC1; p=reject; pct=100) explicitly rejects messages impersonating the brand. Cloudflare Email Security customers receive this enforcement automatically.
  3. Cloudflare Gateway customers are automatically protected against the malicious URLs and domains involved. Check gateway logs for the campaign's IOCs to determine if any internal traffic attempted to reach these sites.
  4. Deploy SVB-themed phishing simulations through awareness and training providers to test end users.
  5. Remind users to be wary of ACH (Automated Clearing House) and SWIFT (Society for Worldwide Interbank Financial Telecommunication) messages. Payment fraud campaigns often use subject lines such as “We've changed our bank details,” “Updated Bank Account Information,” “YOUR URGENT ACTION IS NEEDED - Important - Bank account details change,” and “Financial Institution Change Notice.” While no large-scale SVB-branded ACH campaigns have yet been detected, this style of fraud is common and may be imminent.
  6. Watch for look-alike or cousin domains used in email and web traffic. Cloudflare's email and web filtering includes new-domain controls to block anomalous activity from such domains.
  7. Keep public-facing web applications patched and behind a modern Web Application Firewall (WAF). The observed campaign abused WordPress, a frequent target for phishing infrastructure. A WAF can mitigate third-party CVEs before they are exploited.

Staying Ahead of the Threat

This SVB-focused campaign employs the same tactics used in countless other phishing operations observed daily across the internet. Cloudforce One continues to monitor emerging campaigns during their formative stages and issues advisories and detection model updates to protect customers. Effective defense requires a combination of strong technical controls across communication channels and a vigilant workforce trained to spot suspicious digital communications.