Page 10 - Threat Intelligence 11-15-2019

Social Engineering

Threat Actor Impersonates USPS to Deliver Backdoor Malware. A new threat actor has been found
impersonating the U.S. Postal Service (USPS) and other government agencies to deliver and install backdoor
malware to various organizations in Germany, Italy and the United States, according to new research. The
campaigns, which researchers from cybersecurity firm Proofpoint observed between Oct. 16 and Nov. 12, are
consistent with emerging tactics from bad actors to use increasingly sophisticated social engineering and
spoofing to deliver malware, researchers said. The threat actor sent malicious email messages “targeting no
particular vertical but with recipients that were heavily weighted towards business and IT services,
manufacturing and healthcare,” according to a blog Thursday unveiling the research, posted by the Proofpoint
Threat Insight Team.
Source: https://threatpost.com/threat-actor-impersonates-usps-malware/150242/

PayPal becomes phisher’s favorite brand, Office 365 phishing techniques evolve. PayPal has overtaken
Microsoft to claim the number one ranking for phisher’s favorites for the first time. Netflix was not far behind
as the streaming giant moved up to the third spot with a 14.1 percent QoQ and 73.7 percent YoY growth in
unique phishing URLs, according to Vade Secure. After five quarters, PayPal has become the first brand other
than Microsoft to claim the number one spot in the rankings. In Q3 2019, Vade’s AI engine detected 16,547
unique PayPal phishing URLs for an average of nearly 180 per day. This represents a 69.6 percent YoY increase.
Impersonating PayPal, which had more than 286 million active user accounts in Q2, is clearly a highly
profitable practice for cybercriminals, with no letup in sight.
Source: https://www.helpnetsecurity.com/2019/11/11/office-365-phishing-techniques-evolve/

Scammers favor malicious URLs over attachments in email phishing attacks. Emails containing malicious URLs
made up 88 percent of all messages with malware-infested links and attachments, underscoring the
dominance of URL-based email threats. The findings — disclosed in cybersecurity firm Proofpoint’s quarterly
threat report for the month ending September — reveal the evolving sophistication of social engineering
attacks targeting users and organizations.
Source: https://thenextweb.com/security/2019/11/08/scammers-favor-malicious-urls-over-
attachments-in-email-phishing/

Clever WebEx Spam Use Cisco Redirect to Deliver RAT Malware. A clever spam campaign is underway that
pretends to be a WebEx meeting invite and uses a Cisco open redirect that pushes a Remote Access Trojan to
the recipient. Using open redirects add legitimacy to spam URLs and increases the chances that victims will
click on an URL. An open redirect is when a legitimate site allows unauthorized users to create URLs on that
site to redirect visitors to other sites that they wish. This allows an attacker to utilize the URL of a well-known
and respected company to deliver malware or phishing campaigns.

Source: https://www.bleepingcomputer.com/news/security/clever-webex-spam-use-cisco-redirect-to-
deliver-rat-malware/

www.accumepartners.com
9