New Malware Campaign Targets Financials, Retailers
The attack uses a legitimate remote access system as well as several families of malware.
A new wave of cyberattacks uses legitimate remote access software to take over user accounts in financial services and retail organizations.
According to CyberInt Research Lab, the attack is using the same tools and tactics used in earlier campaigns against financial institutions in Chile, India, Italy, Malawi, Pakistan, and South Korea, and against retailers in the US.
The current attack uses an off-the-shelf commercial remote administration tool called Remote Manipulator System (RMS), developed by a Russian-based company, as one of the malicious payload delivered through a spear-phishing campaign. Malware families including Gussdoor, Xrat, and Vimditator are also being delivered through the targeted malicious email messages.
The cybercrime group behind the attack, TA505, has been active since 2014 and has been involved in campaigns using Dridex and Shifu banking trojans, as well as Locky ransomware and the Neutrino botnet/exploit kit. CyberInt says that an analysis of the code used in all the attacks leads them to believe that the financially motivated gang is made up of native-Russian speakers.
For more, read here.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024