On 3 February 2022, the The UK Office of Gas and Electricity Markets (Ofgem) issued a warning that there has been a “record increase in global gas prices” which saw an “energy price cap rise of 54%”; adding that “Ofgem knows this rise will be extremely worrying for many people”. That last sentence is precisely why phishing threat actors are beginning to use Ofgem-themed lures as a pretext for phishing attacks to target and defraud UK-based users online.
On 17 May 2022, Ofgem issued a warning “of a scam email claiming to be from Ofgem asking for bank details so customers can get a rebate” (see Figure 1). This was followed by an alert from UK Action Fraud stating it has received “over 750 reports in just four days about these fake Ofgem emails”. The UK NCSC also included the warning in its Weekly Threat Report.
Figure 1: Ofgem-themed phishing email
On 20 May 2022, while researching newly phishing pages a recently created Ofgem-themed page was discovered submitted to URLscan.io (see Figure 2). The phishing page poses as the Ofgem website and pretends users are entitled to a rebate (a partial refund to someone who has paid too much for a utility).
Users are promised a “£200 discount on their energy bill” and a “£250 non-repayable Council Tax Rebate payment” if they enter their details. Any users who enter their personal details to “set up a direct debit” into the fake Ofgem site will most likely be targeted for follow-up attacks by the cybercriminals, which could include identity theft, fraud, and account hijacking.
Figure 2: Ofgem-themed ‘Energy Bill Rebate’ phishing page
The phishing page used the following URL: hxxps[:]//ofgem-rebates[.]com/gov/page-1[.]php. The website was registered via PublicDomainRegistry (d.b.a PDR Ltd) and hosted on an IPv4 address: 91[.]235[.]116[.]232 at THCPROJECTS (AS51177), a web host based in Romania. Using the Passive Domain Name System (DNS) feature of OTX Alienvault (see Figure 3), it was possible to uncover four other ‘Ofgem Energy Bill Rebate’ themed phishing pages (see the IOCs section below). The domains were all created within a similar timeframe and used a similar naming pattern. We can assess with high confidence that these were created by the same threat actor.
Figure 3: pDNS discovery of Ofgem-themed domains
The Ofgem-themed campaign is currently in its early stages and has not been reported on yet. As an infosec and anti-fraud community we should anticipate more energy price related campaigns. Any major event or news cycle is often quickly leveraged by cybercriminals and this is just the latest one.
Some analysts reading this may have also noticed that the same IP address used for this Ofgem-themed campaign has also been recently used in the month of May for hosting other phishing pages posing as Santander Bank and Facebook, among various other brands. This could mean that THCPROJECTS (AS51177) is a preferred Romania-based host for phishing threat actors. This, however, is not a good indicator that the threat actors responsible are Romanian, as anyone from anywhere can pay to host a site with this host.
