New Malware Campaign Targets Financials, RetailersNew Malware Campaign Targets Financials, Retailers
The attack uses a legitimate remote access system as well as several families of malware.
April 18, 2019
A new wave of cyberattacks uses legitimate remote access software to take over user accounts in financial services and retail organizations.
According to CyberInt Research Lab, the attack is using the same tools and tactics used in earlier campaigns against financial institutions in Chile, India, Italy, Malawi, Pakistan, and South Korea, and against retailers in the US.
The current attack uses an off-the-shelf commercial remote administration tool called Remote Manipulator System (RMS), developed by a Russian-based company, as one of the malicious payload delivered through a spear-phishing campaign. Malware families including Gussdoor, Xrat, and Vimditator are also being delivered through the targeted malicious email messages.
The cybercrime group behind the attack, TA505, has been active since 2014 and has been involved in campaigns using Dridex and Shifu banking trojans, as well as Locky ransomware and the Neutrino botnet/exploit kit. CyberInt says that an analysis of the code used in all the attacks leads them to believe that the financially motivated gang is made up of native-Russian speakers.
For more, read here.
About the Author(s)
You May Also Like
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingDec 12, 2023
SecOps & DevSecOps in the CloudDec 14, 2023
What's In Your Cloud?Jan 17, 2024
Everything You Need to Know About DNS AttacksJan 18, 2024