Global Scale Phishing Attack Brings New Malware

May 20, 2021

Written by wukovits

Planet Earth

There’s an ongoing, global scale phishing attack you should be aware of, even if your firm isn’t currently being targeted by it.

The attack is being tracked by Mandiant, who recently published a report about it. According to that report, the attack was planned in waves, hitting more than 50 different organizations spanning a broad range of industries.

These attacks happened on December 2nd, December 11th, and again on December 18th, 2020.

There are two things that make this attack particularly worrisome. First, Mandiant was unable to identify a specific threat actor behind them. Due to that, they’re simply tracking the group as “UNC2529,” with the UNC identifier tagging the group as currently unknown and uncategorized.

Second is the fact that there’s obviously a high level of talent behind the attacks, as it uses highly targeted spear phishing techniques to deploy three different strains of malware never seen before. Even worse is the fact that the group has taken great pains to ensure that their malicious code lands on target systems undetected.

A spokesman for Mandiant had this to say about the attacks:

The threat actor made extensive use of obfuscation and fileless malware to complicate detection to deliver a well coded and extensible backdoor.

One interesting fact about the whole ecosystem is that only the downloader exists in the file system. The rest of the components are serialized in the registry database, which makes their detection somewhat harder, especially by file-based antivirus engines.

Masquerading as the account executive, seven phishing emails were observed targeting the medical industry, high-tech electronics, automotive and military equipment manufacturers, and a cleared defense contractor with subject lines very specific to the products of the California-based electronics manufacturing company.”

The majority of the attacks have been focused on the United States. However, roughly a quarter of them have hit organizations in Europe, Asia and Africa, making it a truly global campaign. Stay vigilant. As yet, no clear picture has emerged regarding the ultimate aims and goals of this mystery group.

Used with permission from Article Aggregator

Related Articles

Some Amazon Device Features May Have Security Risks

Have you heard of Amazon Sidewalk? If not, it's definitely something you should be aware of. Depending on your point of view, the new feature, which was enabled by default on a wide range of Amazon devices by default on June 8 of this year (2021) is either...

Email Unsubscribe Scam Can Easily Fool Any User

Scammers are increasingly relying on a tried and true bit of social engineering to fool unsuspecting users into unwittingly signing up to receive a flood of additional spam email. They accomplish this by blasting out an email asking recipients if they wish to...

Update VMWare Software Immediately To Avoid Possible Attack

The US Cybersecurity and Infrastructure Security Agency recently issued a warning to all companies running VMware Vcenter Server and VMware Cloud Foundation. They are asking them to download and apply the latest security patches as soon as possible because attackers...

Send us a message

Your message was sent.

Thank you for contacting Bayou Technologies. We'll be in touch soon!

Need help? support-icon