[HEADS UP] New Malware Families Found in Phishing Campaign

Researchers from FireEye's security team found new malware families in a financial phishing campaign. The Malware strains are dubbed Doubledrag, Doubledrop, and Doubleback and have been detected.

So far, this campaign has targeted US, EMEA, Asia, and Australia regions. The attack has been rolled out in two phases. This campaign has been achieved by the bad guys posing as account executives that represented various  industries. 

While the phishing emails contain a PDF attachment it also included a .js file. Victims believed that since the PDF file was 'unreadable', they attempted to double click on the .js file. Unfortunately, that resulted in the Doubledrag downloader being executed. 

Doubledrag then proceeds to download a dropper (i.e. the Doubledrop malware strain) in order to kick in the second phase of the attack. Doubledrop then proceeds to completely own the infected machine by loading a backdoor (ie the Doubleback strain) into memory. 

The researchers from FireEye said in a statement, "Although Mandiant has no evidence about the objectives of this threat actor, their broad targeting across industries and geographies is consistent with a targeting calculus most commonly seen among financially motivated groups,"

While the analysis of the strains are ongoing, these phishing attacks are not going to stop anytime soon. Measures taken such as frequent phishing tests or new-school security awareness training can prepare your users in the event they receive a malicious email. 

ZDNet has the full story.