 CyberheistNews Vol 6 #20 |
| [ALERT] New Evil Android Phishing Trojans Empty Your Bank Account |
.jpg)
Infragard warned that the FBI has identified two Android malware families, SlemBunk and Marcher, actively phishing for specified US financial institutions’ customer credentials. The malware monitors the infected phone for the launch of a targeted mobile banking application to inject a phishing overlay over the legitimate application’s user interface.
The malware then displays an indistinguishable fake login interface to steal the victim’s banking credentials. According to cyber threat industry reports, both malware families have targeted foreign financial institutions since 2014, gradually broadening the list to include Western banks, and offered the malware for lease or purchase, respectively, in underground forums.
At least as of December 2015, the malware expanded its configuration to include the Android package names of US financial institutions. SlemBunk apps masquerade as common, popular applications and stay incognito after running for the first time. They have the ability to phish for and harvest authentication credentials when specified banking and other similar apps are launched.
Users will only get infected if the malware is sideloaded or downloaded from a malicious website. Newer versions of SlemBunk have been observed being distributed via porn websites. Users who visit these sites are incessantly prompted to download an Adobe Flash update to view the porn, and doing so downloads the malware.
Read What To Do About It at the Knowbe4 blog, with a copy/paste message to email to your users:
https://blog.knowbe4.com/new-evil-android-phishing-trojans-empty-your-bank-account
|
| Latest Petya v2.0 Comes Loaded With Double-Barrel Ransomware Attack |
|
A new twist on the Petya ransomware and how it now uses a backup ransomware attack. Remember, Petya is a new type of ransomware that doesn’t encrypt specific files but makes the entire hard drive inaccessible by overwriting the master boot record.
A new version of the Petya installer was released with a really "interesting" feature.
Up until now, the Petya installer required administrative privileges to launch. That meant that if someone said no at the UAC prompt, it didn’t install, and thus no payload released.
The criminal developers behind Petya did something clever though. They now have an installer that offers Petya plus a backup "conventional" file-encrypting ransomware called Mischa. When the installer runs, it will try to install Petya and if it does not get admin privs, it defaults back to the Mischa ransomware that installs with standard user privs, making this the first double-barrel ransomware attack.
The Attack Vector: Phishing
The installer for Petya/Mischa is distributed via emails pretending to be job applications. These emails contain a link to a cloud storage service that contains an image of the supposed applicant and a downloadable executable that starts with PDF. Get more details about this strain at the KnowBe4 Blog:
https://blog.knowbe4.com/new-petya-comes-loaded-with-double-barrel-ransomware-attack
|
| This Has Been A Crazy Week In Ransomware |
|
That's what Larry Abrams from Bleepingcomputer started out with yesterday, and he was right! We have had six new ransomware strains, one new RaaS (Ransomware-as-a-Service) and one major update of an existing strain. Get all the detail at this blog post which has links to screen shots, descriptions, decryptors and more:
https://blog.knowbe4.com/this-has-been-a-crazy-week-in-ransomware
|
| Poll Results: "Should Someone Who Falls For A W-2 Phishing Attack Be Fired?" |
|
It's an interesting question, because the specific circumstances were explained in an article about this particular incident. There were 186 answers to this poll, and here are the results of question 1, which asked if the employee should be fired.
YES - 20%
NO - 16%
Depends on the circumstances 60%
Other 4%
The second and last question asked for the rationale behind their answer. I read them all, and the vast majority agreed that it should be driven by a fairly standard approach you could call "increasingly severe consequences", where someone first gets trained, made part of an ongoing awareness program, and given a first, second and/or third warning before they get terminated.
Here are three opinions of system admins, quoted at the KnowBe4 blog:
https://blog.knowbe4.com/poll-results-should-someone-who-falls-for-a-w-2-phishing-attack-be-fired
|
| If This Is Your First Issue Of CyberheistNews... |
|
CyberheistNews is the world's largest e-zine for IT professionals about social engineering and security awareness training, it is published by KnowBe4 Inc, arrives in your inbox once a week and looks at IT security from the human side. KnowBe4 has partnered with Kevin Mitnick to create new school Security Awareness Training combined with regular simulated phishing attacks.
In CyberheistNews we aim to help you keep your network safe with important news, hints, and tips so that you are aware of the latest social engineering scams and can do something about it.
KnowBe4 lives 100% in the cloud, we use SalesForce as our CRM and via their Data.com service we licensed your address. Consider this your sample issue. You can unsubscribe at any time (a few lines below), and you will stop receiving any and all further email.
|
Warm Regards,
Stu Sjouwerman |
|
|
|
