Attacks/Breaches

8/2/2018
07:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Industrial Sector Targeted in Highly Personalized Spear-Phishing Campaign

At least 400 companies in Russia have been in the bullseye of new, sophisticated spear-phishing attacks, Kaspersky Lab says.

A sophisticated new phishing campaign targeting organizations in the industrial sector shows yet again how attackers are constantly improving at luring high-value users into executing malware on their systems.

In a technical advisory Wednesday, security vendor Kaspersky Lab said it has observed a wave of spear-phishing emails expertly disguised as procurement and accounting letters being sent to carefully selected individuals at companies mostly in Russia. The attackers have typically been targeting finance and project-management related employees at these companies, and the main goal appears to be to steal money from victim organizations.

So far, the threat actors behind the campaign have targeted at least 800 computers across 400 organizations in industries such as energy, manufacturing, oil and gas, logistics, and construction.

The emails are usually addressed to the targeted individuals by their full name and contain content — such as invitations to tender bids — that corresponds with their company's business and the individual's job roles.

The malicious attachments in many of the emails have names that suggest a connection with finance. In some cases, the attackers have been sending emails with no attachments but with links embedded in the content to external sites from where malware can be downloaded to their system. The domain names from which the emails are sent are usually very similar to the domain name of the organization that purportedly sent them.

The attackers have been using various tactics to mask infections, Kaspersky Lab said in its report. If a user is tricked into opening a malicious attachment purporting to be about procurement tenders, for instance, a modified version of a legitimate software tool to search for tenders is installed on the victim system along with the malware.

The malware is used to install either TeamViewer or some other legitimate utility for remotely controlling infected systems. The attackers have then been using their remote access to inspect compromised systems for documents pertaining to financial, accounting, and procurement operations with a view to using them to enable financial fraud.

One tactic has been to change details in payment bills so payments are sent to the attackers rather that the intended organization, Kasperksy noted. When the attackers want additional information or access to other systems, they install additional malware to enable that goal. 

Kaspersky Lab's analysis of the phishing campaign suggests that the attackers started the campaign last October and targeted a relatively short list of companies through March this year, says Kirill Kruglov, senior research developer at Kaspersky Lab.

Since then, the attackers have broadened their attacks and are now going after a much broader set of targets.

"There could be at least two explanations," for why the attackers began small and then expanded their target list, Kruglov says. "[Either] the attackers collected data during the attack month by month, or they tested the attack vector on some portion of the information they had before launching it in full scope."

Financial Goals

So far, the attackers appear focused only on stealing money. The attackers use spyware to collect data and credentials for propagating inside victim networks. But there has been no evidence of purposeful interest in espionage and data theft.

While the task of assembling the information needed to carry out a targeted and highly personalized phishing campaign of this sort might appear enormous, in reality it isn't, Kruglov notes.

Usually, threat actors collect public information from corporate websites, social networks, and other sources. Or they could simply buy it on hacker forums or the dark net. "This means it is not much work. A few months are more than enough for threat actors to prepare such an attack," he says.

Kaspersky Lab's report is the second reminder of the growing sophistication of spear-phishing campaigns and the enormous success that it is netting threat actors. On Wednesday, US law enforcement authorities announced the arrests of three Ukrainian nationals connected with FIN7, a group believed responsible for stealing data on more than 15 million payment cards from organizations such as Saks Fifth Avenue, Chipotle and Arby's.

In many of the attacks, FIN7 operatives sent carefully crafted spear-phishing emails to vetted individuals at the targeted organization with the goal of installing malware on their systems for enabling payment card theft. FIN7 members even went to the extent of making phone calls to targeted individuals either before or after sending them a phishing email to try and bolster the credibility of their phishing lure.

"The level of meticulous detail in targeting more than eight hundred employees' PCs in today's widespread Eastern European spear-phishing campaign confirms what we've been seeing for some time," said Rohyt Belani, CEO and co-founder of Cofense. "Global phishing actors continue to leverage more personalized, spear-phishing campaigns as a sure-fire way to bypass next-generation email gateways and perimeter controls."

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20168
PUBLISHED: 2018-12-17
Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service ("physical address not valid" panic) via a crafted application.
CVE-2018-20167
PUBLISHED: 2018-12-17
Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME typ...
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.