Fake podcast invitation

In the attack intercepted by Proofpoint, which started at the end of July, TA453 impersonated the research director of the Institute for the Study of War (ISW), a well-known think tank and research organization that specializes in analyzing armed conflicts. The target, a prominent Jewish figure, was approached with an invitation to appear as a guest on ISW’s podcast.

After the victim replied, the attackers followed up with an URL to DocSend, a document sharing service, that was password protected and hosted a .txt file. The file was benign and simply contained a link to the legitimate ISW podcast. Proofpoint’s researchers believe that by using this approach, the attackers intended to normalize clicking on an URL, entering a password and opening a file for the victim, so they would feel safe doing the same in the future when the real malicious payload was delivered.

After another response from the victim accepting the invitation to participate in the podcast, the attackers sent another email with an URL to a password-protected ZIP archive hosted on Google Drive that they presented as a contract and the podcast session plan.