Date: February 21, 2018

Description: IRIS has found groups of Nigerian origin are harvesting credentials and phishing Fortune 500 companies with the harvested credentials in an attempt to steal financial assets. The most common attack is attempted wire fraud. The attackers has successfully used business emails (via spoofing of addresses in a victim’s contact book, or inserting themselves into current email conversations) to convince accounts payable personnel at Fortune 500 companies to initiate wire transfers into attacker-controlled accounts. Millions have already been stolen in the current campaign.

The current campaign is especially dangerous due to the sophisticated nature of the social engineering tactics. By disguising themselves as users known to the victim and inserting themselves into current conversations they are able to convince even wary employees of their validity.

Beware of suspicious emails

Implement two factor authentication for account logins, especially email accounts

Block auto-forwarding of emails outside of the network. This forces the attacker to log into the email account directly, increasing their chances of being detected

Train users to recognize social engineering attacks and to verify vendors asking for different than usual wire transfers via a different medium than was used to contact about the wire transfer

Reported: February 21, 2018

Details: A group, dubbed Reaper, allegedly based out of North Korea are using a recently disclosed Adobe vulnerability, which had been a zero-day up to that point. They have been targeting companies in all industries, though most recently financial companies with a phishing email that contains a Microsoft Word attachment. The attachment installs malware which allows Reaper to collect information, such as taking screenshots of the infected system. Reaper is known to use targeted spearphishing attacks, making their phishing emails more effective and realistic than generic templates, often being able to bypass spam filters.

Reference:

Reported: February 15, 2018

Details: Trend Micro has reported a series of attacks involving exploiting CouchDB database management system for unpatched vulnerabilities. Attackers install monero miners in order to mine the cryptocurrency for the attacker.

 References:

Reported: February 15, 2018

Details: A Bitcoin theft campaign is being conducted through google adwords. By purchasing ads with the term “blockchain” or “bitcoin wallet”, attackers are able to host malicious sites that gather credentials of users whom navigate to them. The malicious sites show up on Google as a featured site, and often utilize valid SSL certificates through Let’s Encrypt, so appear legitimate. The harvested credentials are used to steal Bitcoins from users’ Bitcoin wallets.

References: