Threat Actors Exploiting Free Email Services to Target Government and Educational Institutions

Threat actors are increasingly leveraging free email services to infiltrate government and educational institutions, exploiting these platforms’ accessibility and widespread use.

Increasing Sophistication in Cyber Threats

Recent investigations reveal that advanced persistent threat (APT) groups, such as GreenSpot, have employed phishing campaigns targeting free email services like 163.com to steal credentials and sensitive data.

This trend underscores the growing sophistication of cybercriminals in exploiting seemingly innocuous platforms to compromise critical sectors.

GreenSpot, an APT group active since 2007, has been observed using spoofed domains and fake login pages mimicking legitimate email services.

These malicious infrastructures are designed to harvest user credentials by redirecting victims to counterfeit login interfaces.

For instance, domains like “mail.eco163[.]com” closely replicate the legitimate 163.com email service interface, tricking users into divulging their credentials.

Such tactics highlight the vulnerabilities inherent in free email services when ...