The Quantum Route Redirect Kit: a new wave of targeted phishing attacks

• Human vs. Bot Detection: The kit can differentiate between real human traffic and automated bots or scanners, redirecting real users to phishing sites while sending bots to harmless, benign domains (e.g., google.com).
• Targeted Phishing: Once a real user is identified, they are directed to a phishing page designed to harvest credentials. These credentials provide access to sensitive company data, making them a prime target for attackers.
• Centralized Control via the Quantum Dashboard: Cybercriminals can manage all aspects of their phishing campaigns through a centralized dashboard, which allows them to track victim activity, configure redirection rules, and analyze victim logs in real-time.

During our investigation, we gained access to several active Quantum dashboards, allowing us to review campaign configurations, redirection rules, and victim data. In one case, we observed that 1,052 users attempted to visit a phishing site. While the kit's configuration was somewhat flawed, leading to many users being incorrectly categorized as bots and redirected to safe domains, we were able to extract valuable intelligence about the attack infrastructure.

The malicious infrastructure discovered is actively blocked through our SecureDNS solution.

Our SOC team also got access to the complete Quantum Redirect Phishing Kit and analyzed it thoroughly.
This played a critical role in understanding how the threat actors differentiate bots from humans, and allows us to better protect our customers.

Our deep dive into the Quantum Route Redirect Kit revealed several critical findings.

• Over 600 malicious domains: We identified more than 600 domains used in these phishing campaigns, all of which have been blocked by SecureDNS to prevent any further threat to our customers.
• IP address analysis: We recovered logs of IP addresses marked as “phished” or redirected to malicious content. These IPs were cross-referenced with our internal telemetry, and we can confirm that none of our customers were affected by this phishing kit at the time of our analysis.
• Frequent misconfigurations: The Quantum Route Redirect Kit is often poorly optimized and misconfigured, meaning that a significant number of users were incorrectly flagged as bots and thus redirected to a benign domain. We’ve used this knowledge to further refine our detection mechanisms to ensure that similar errors do not result in any missed threats.
• What was labelled online as a highly sophisticated phishing kit turned out to be a poorly developed phishing kit.
• The phishing kit didn't follow any of the best practice of coding in terms of security such as :
  • protecting direct access to the configuration file, protecting administrative pages and source code.
  • All the configurations and "phishing domains" were also accessible without needing to log into the admin panel of the Quantum Route Redirect Kit.
  • This poor optimization allowed us to gain access to a lot of info on the phishing kit.
• The phishing kit was developed to 'detect' bots and differentiate them from real humans.
  The way the code determines whether you are a bot or not is really simple:
  • The first check will see if you are using a known browser. With known browser we mean a browser that is in the list of browsers attached to the phishing kit.
  • After that it will check what type of device you are on. This could be mobile, Mac, Windows, …
  • If one of those conditions are not complete you are categorized as a "bot".
  • This also means that if you are using a browser like Brave or one that is not present in the list you will also automatically be redirected to the "bot"  URL.

Although early reports indicated that 80% of victims of Quantum-based phishing campaigns originate from the United States, our investigation uncovered a different pattern. We observed significant targeting in Western Europe, we detected nearly 2000 European IP addresses that were logged on those portals as having made a connection to the Phishing Kit.

Most of them were detected as BOT, and some were redirected to the second stage of the phishing cycle.

The affected countries included:

• Belgium
• France
• Germany
• Switzerland
• Austria
• The Netherlands

While we’ve taken extensive measures to secure our customers, we also encourage you to follow these best practices to further reduce the risk of phishing and other cyber threats:

• Enable Multi-Factor Authentication (MFA)
  MFA is one of the most effective ways to protect accounts even if credentials are compromised.
• Use Conditional Access and Risk-Based Sign-In Policies (for M365 tenants)
  Use policies to restrict access based on user behavior, location, or device risk, helping to block unauthorized access.
• Be cautious with links in emails or SMS
  Always be wary of unsolicited emails or text messages containing links. When in doubt, carefully check the domain or manually go to the official company website and check whether or not the communication is also available there.
• Verify login pages
  Double-check the URL of any login page before entering credentials. Authentic M365 login pages should always belong to Microsoft-owned domains.
• Keep systems fully updated
  Ensure your browsers, operating systems, and security software are always up to date with the latest patches.
• Report suspicious emails immediately
  If you receive a suspicious email, report it to your organization.
  You can also forward suspicious messages to suspicious@safeonweb.be. 

Thanks to our proactive measures and continuous analysis of the Quantum Route Redirect Kit, we have successfully blocked a majority of the domains associated with this phishing threat, ensuring that your organization remains safe. We will continue to monitor and adapt our defenses to stay ahead of emerging threats, so you can focus on what matters most to your business.

For more information or questions, don’t hesitate to reach out to our Support Team via support@secutec.com