COVID-19 Spam Delivers Remcos RAT

iStock-1219225761A phishing campaign is impersonating the US Small Business Administration (SBA) in an attempt to deliver the Remcos remote access Trojan, according to researchers at IBM X-Force. The campaign began in late March, just before the US government approved the CARES act, which included $376 billion in relief funds for small businesses. Attackers are aware that small businesses in the US will be tend to be responsive to emails from the SBA, so they’ve crafted phishing lures along these lines.

The phishing emails observed by X-Force contained the SBA’s branding, and they deliver a malicious attachment. The email body informs the recipient that the attachment is a document that needs their signature. Some of the emails referenced the SBA’s real Paycheck Protection Program (PPP). The attachments are UDF files containing executables that will deliver the Remcos information stealer. Remcos is a RAT that purports to be a legitimate remote access tool, but is more well-known for its use in malware campaigns.

X-Force concludes that the criminals are exploiting businesses that are struggling financially during the COVID-19 pandemic. Since the attackers know which type of content small business owners will be expecting, they can tailor their phishing campaigns accordingly.

“As small businesses throughout the U.S. are impacted by the commercial effects of the ongoing COVID-19 pandemic, cybercriminals are trusting that people will be on the lookout for information regarding relief payments and more likely to open unsolicited emails purporting to come from relevant entities,” they write. “The suspicious emails uncovered by X-Force are evidence of actors exploiting the reliance of individual users and small businesses on digital updates to obtain guidance on how to receive federal aid.”

The researchers expect this activity to continue as the pandemic continues and more government relief efforts are approved. New-school security awareness training can help your employees stay safe as they navigate the evolving threat landscape.

SecurityIntelligence has the story:

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Cybersecurity Awareness Month Resource Kit

Get the latest about social engineering

Subscribe to CyberheistNews