Full Report
Alleged developer arrested in Indonesia after more than 200 servers slain
Analysis Summary
# Incident Report: Takedown of Kratos Phishing-as-a-Service (PhaaS) Infrastructure
## Executive Summary
International law enforcement agencies, led by Germany’s ZIT and BKA, successfully dismantled the "Kratos" PhaaS infrastructure, resulting in the neutralization of over 200 servers. An Indonesian national, alleged to be the kit’s primary developer and administrator, was arrested during the coordinated strike. The kit enabled over 1,800 criminal affiliates to conduct large-scale credential theft and session hijacking targeting Microsoft 365 users globally.
## Incident Details
- **Discovery Date:** January 2026 (First identified by security researchers)
- **Incident Date:** Takedown announced July 21, 2026
- **Affected Organizations:** Hundreds of thousands of individual victims; over 1,800 criminal "enterprises" used the kit.
- **Sector:** Cross-sector (Manufacturing, Retail, Healthcare, Education, and Legal)
- **Geography:** Global (Developer arrested in Indonesia; primary targets in US and Europe)
## Timeline of Events
### Initial Access
- **Date/Time:** Active since early 2024 (as SneakyLog/Sneaky 2FA) or January 2026 (as Kratos).
- **Vector:** Phishing via lures (Tax forms, SharePoint links, OneDrive notifications).
- **Details:** Use of convincing Microsoft-themed login pages to capture credentials in real-time.
### Lateral Movement
- **Mechanism:** Attackers leveraged stolen session cookies and passwords to bypass Multi-Factor Authentication (MFA) and gain direct access to corporate cloud environments (Microsoft 365).
### Data Exfiltration/Impact
- **Losses:** Captured login credentials and session tokens from hundreds of thousands of victims across 30+ countries.
- **Revenue:** The operation generated over €300,000 ($342,000) for the kit developers.
### Detection & Response
- **Discovery:** Identified through open-source intelligence and investigations by Microsoft, KnowBe4, and ANY.RUN.
- **Response Actions:** Joint operation by German BKA, ZIT, US authorities, and Indonesian police. Neutralized central infrastructure and executed legal warrants against hosting providers.
## Attack Methodology
- **Initial Access:** Phishing-as-a-Service (PhaaS) using templates for SharePoint, OneDrive, and Canva.
- **Persistence:** High-volume campaigns (15,000/month) maintained through a vast network of 200+ servers.
- **Privilege Escalation:** Not applicable (Focus on initial account takeover).
- **Defense Evasion:** Use of Cloudflare anti-bot checks and "sinkholing" prevention; kit evolved from previous infostealer/trojan families to stay ahead of signatures.
- **Credential Access:** Harvesting of plaintext passwords and session cookies (Adversary-in-the-Middle).
- **Discovery:** Automated scanning for Microsoft 365 environments.
- **Lateral Movement:** Session hijacking to move from web-based auth to internal cloud resources.
- **Collection:** Centralized dashboards for "low-skill" criminals to collect stolen data.
- **Exfiltration:** Automated transfer of stolen credentials to the PhaaS backend.
- **Impact:** Significant financial gain for operators and widespread account compromises for victims.
## Impact Assessment
- **Financial:** Over €300,000 in illicit revenue; unknown total losses for victimized organizations.
- **Data Breach:** High volume of PII (W-2 forms) and corporate login credentials.
- **Operational:** Disruption of business activities through account lockouts and unauthorized access.
- **Reputational:** Damage to affected organizations, particularly in healthcare and legal sectors.
## Indicators of Compromise
- **Network Indicators:** Traffic to suspicious domains masquerading as `sharepoint-docs[.]com` or `microsoft-verify[.]net` (defanged examples).
- **File Indicators:** HTML phishing attachments with embedded JavaScript for credential harvesting.
- **Behavioral Indicators:** Unexpected Cloudflare challenges on login pages; logins from unusual locations bypassing MFA via session tokens.
## Response Actions
- **Containment:** Legal warrants served to hosting companies to seize servers.
- **Eradication:** ISP coordination to "null-route" or "sinkhole" traffic associated with Kratos IP addresses.
- **Recovery:** Law enforcement takedown of the primary 200+ server infrastructure.
## Lessons Learned
- **Key Takeaways:** PhaaS lowers the barrier to entry, allowing non-technical actors to run 15,000 monthly campaigns. MFA is not a silver bullet against session cookie theft.
- **Improvements:** Broader industry adoption of FIDO2-compliant hardware keys could prevent the credential/session harvesting techniques used by Kratos.
## Recommendations
- **Identity Security:** Implement phishing-resistant MFA (conditional access policies that require managed devices or physical tokens).
- **Monitoring:** Monitor for anomalous session cookie usage and token theft (e.g., sessions appearing in new geographic locations without a fresh login).
- **Education:** Conduct training on identifying advanced phishing lures involving SharePoint and common SaaS platforms.