A phishing campaign is impersonating the US Small Business Administration (SBA) in an attempt to deliver the Remcos remote access Trojan, according to researchers at IBM X-Force. The campaign began in late March, just before the US government approved the CARES act, which included $376 billion in relief funds for small businesses. Attackers are aware that small businesses in the US will be tend to be responsive to emails from the SBA, so they’ve crafted phishing lures along these lines.
The phishing emails observed by X-Force contained the SBA’s branding, and they deliver a malicious attachment. The email body informs the recipient that the attachment is a document that needs their signature. Some of the emails referenced the SBA’s real Paycheck Protection Program (PPP). The attachments are UDF files containing executables that will deliver the Remcos information stealer. Remcos is a RAT that purports to be a legitimate remote access tool, but is more well-known for its use in malware campaigns.
X-Force concludes that the criminals are exploiting businesses that are struggling financially during the COVID-19 pandemic. Since the attackers know which type of content small business owners will be expecting, they can tailor their phishing campaigns accordingly.
“As small businesses throughout the U.S. are impacted by the commercial effects of the ongoing COVID-19 pandemic, cybercriminals are trusting that people will be on the lookout for information regarding relief payments and more likely to open unsolicited emails purporting to come from relevant entities,” they write. “The suspicious emails uncovered by X-Force are evidence of actors exploiting the reliance of individual users and small businesses on digital updates to obtain guidance on how to receive federal aid.”
The researchers expect this activity to continue as the pandemic continues and more government relief efforts are approved. New-school security awareness training can help your employees stay safe as they navigate the evolving threat landscape.
SecurityIntelligence has the story: https://securityintelligence.com/posts/sba-spoofed-in-covid-19-spam-to-deliver-remcos-rat/
Here's how it works:
