Another group is impersonating USPS, tax entities around the globe in order to steal money

A new scheme has seen a nefarious actor impersonating the United States Postal Service and tax entities in recent weeks in an effort to get victims in the U.S., Italy, and Germany to download and install malware, according to new research from Proofpoint. The scheme has been trying to trick victims into clicking through spearphishing emails that contain ransomware — and at times banking trojans — by sending alerts that appear to require urgent action related to tax information. Of course, what’s really taking place is a money-making ploy, according to Proofpoint researchers. The scheme — it’s unclear whether it’s being carried out by one person or a group — also works to trick victims by appearing to imitate government taxation entities or the USPS by using lookalike domains and branding. In one case last month, German-based accounts were targeted with hundreds of spearphishing emails that looked to be from […]

The post Another group is impersonating USPS, tax entities around the globe in order to steal money appeared first on CyberScoop.

Continue reading Another group is impersonating USPS, tax entities around the globe in order to steal money

DanaBot banking trojan hits Germany again, with new targets

DanaBot, a banking trojan that has targeted organizations in Australia, Europe, and North America, has expanded its targets in Germany as of this June in a new campaign, according to new research from Webroot. While the trojan — which steals users’ banking credentials via malicious JavaScript injects — initially began targeting Australian banks in 2018, the targets identified in this new campaign are outside of the financial sector. Webroot Advanced Threat Research Analyst Jason Davison tells CyberScoop that the targets are a range of victims in retail, including the German websites for fashion brands H&M and Esprit, along with lodging rental platform Airbnb. The campaign is primarily unleashed via spear phishing emails containing malicious links or files to download, Davison says. “Once the loader module gets downloaded and is run, it sets up persistence (the ability to stay on a device through a reboot) on the victim’s machine and then […]

The post DanaBot banking trojan hits Germany again, with new targets appeared first on CyberScoop.

Continue reading DanaBot banking trojan hits Germany again, with new targets

Cerberus: A New Android ‘Banking Malware For Rent’ Emerges

After a few popular Android Trojans like Anubis, Red Alert 2.0, GM bot, and Exobot, quit their malware-as-a-service businesses, a new player has emerged on the Internet with similar capabilities to fill the gap, offering Android bot rental service to t… Continue reading Cerberus: A New Android ‘Banking Malware For Rent’ Emerges

The Curious Case of a Fileless TrickBot Infection

Reading Time: 7 minutes IBM X-Force noted changes in the deployment of the TrickBot Trojan and discovered that the most recent version of the malware is fileless.

The post The Curious Case of a Fileless TrickBot Infection appeared first on Security Intelligence.

Continue reading The Curious Case of a Fileless TrickBot Infection

How Prepared Is the Financial Services Sector to Respond to a Systemic, Global Cyberattack?

Due to its interconnected nature, the financial services industry needs to prepare to respond to a systemic cyberattack that could impact its overarching infrastructure across borders.

The post How Prepared Is the Financial Services Sector to Respond to a Systemic, Global Cyberattack? appeared first on Security Intelligence.

Continue reading How Prepared Is the Financial Services Sector to Respond to a Systemic, Global Cyberattack?

TrickBot: New Injects, New Host

What’s in the Name: Call it IcedID or TrickBot? Tell that to a security researcher (Arsh Arora in this case) and watch them RANT
(Gar-note: today’s blog post is a guest blog from malware analyst, Arsh Arora…) 

Today’s post starts w… Continue reading TrickBot: New Injects, New Host