theDocumentId => 747110 Multiple Phishing Attacks Target Top Universities

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Phishing

10/26/2018
09:35 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Multiple Phishing Attacks Target Top Universities

Kaspersky Labs sent out a warning this week that multiple phishing campaigns have targeted more than 100 universities and schools over the past year, including the University of Washington, Cornell University and others.

Over the past year, multiple phishing campaigns have targeted major universities and schools in over 100 different countries, including several US-based institutions, with threat actors looking to steal research and other intellectual property or to gather more credentials for future attacks.

The schools targeted by these phishing attacks include the University of Washington, Cornell University, Harvard Business School, Stanford University and the University of Iowa. All told, 131 universities in 16 countries were subject to these malicious campaigns.

For the last 12 months, Kaspersky Lab has been tracking these attacks, and warning schools and universities about ongoing phishing campaigns. The company published its findings in a October 24 blog post, and noted that none of the schools sustained a data breach but that these incidents are continuing.

In an email to Security Now, Nadezhda Demidova, security researcher at Kaspersky Lab and the author of the report, wrote that while these various phishing campaigns could be the work of the same group, researchers do not have proof that these attacks are coordinated.

Example of fake university websites used in phishing campaigns\r\n(Source: Kaspersky)\r\n
Example of fake university websites used in phishing campaigns
\r\n(Source: Kaspersky)\r\n

However, what Kaspersky found was that these attacks are designed to steal research, as well as credentials and other data, such as the IP address of the victim's device.

"Our assumption is that the main goal of these attacks was to gain access to research," Demidova wrote. "However, scammers are interested in any personal information, as they can sell it or use in the future to create spear-phishing attacks aimed at a specific person or organization."

In its blog post, Kaspersky research describes similar techniques used in these different campaigns. In most cases, the attackers created a fake webpage that was made to look like the university's official site or an intranet portal associated with the school. These pages contained a few letters that were different from the official URL.

The sites were spread to students and staff through various social engineering techniques and any data or credentials entered into these phony site were sent to the attackers, Demidova added:

Phishing attacks have long spread not only through email, but through any available means. Since attacks are recorded regularly around the world, the methods of distribution can be completely different. The main purpose of the scammers in this case is to lure the victim to a fake website and encourage them to enter their account login data.

Overall, Kaspersky detected nearly 1,000 phishing attacks in 12 months, with 83 different campaigns targeting US-based schools and another 21 aimed at UK universities. Attacks were also recorded in Finland, Colombia, Hong Kong, India, Israel, the Netherlands, New Zealand, Poland, South Africa, Sweden, Switzerland and the UAE.

The University of Washington seemed a particularly popular target. That school accounted for over 11% of all attacks.

While phishing is one of the oldest problems in cybersecurity, these attacks have increased in scale and sophistication as of late, with Barracuda Networks and Palo Alto Network's Unit 42 describing a surge in phishing over the past year. (See Phishing Attacks Are Increasing & Gaining in Sophistication.)

In more traditional enterprises, security teams have seen an increase in Business Email Compromise (BEC) and Email Account Compromise (EAC) attacks, which use a combination of cheap hacking tools and phishing techniques to steal the credentials of company executives. (See Attackers Can Compromise Corporate Email Accounts for $150.)

For schools and universities, Kaspersky is offering some practical advice to counter these phishing attacks, including:

  • Always check the link address and the sender's email to determine if they are genuine before clicking. If you receive a link through email that appears suspicious, type it into the browser's address line instead of clicking through the email.
  • If you are not sure that a website is real and safe, never enter your credentials. If you think that you may have entered your login and password on a fake page, change your password immediately.
  • Avoid using the same password for several websites or services, as it puts all of your accounts at risk if your login to one site becomes compromised.

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26180
PUBLISHED: 2021-07-28
Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport user account. A remote malicious user with low privileges may gain access to data stored on the /ifs directory through most protocols.
CVE-2020-5341
PUBLISHED: 2021-07-28
Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated ...
CVE-2020-5351
PUBLISHED: 2021-07-28
Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only privilege...
CVE-2021-32788
PUBLISHED: 2021-07-27
Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal mes...
CVE-2021-32796
PUBLISHED: 2021-07-27
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes durin...