A social engineering campaign is targeting entities in the Middle East using malware that impersonates Palo Alto Networks’ GlobalProtect VPN, according to researchers at Trend Micro.
The malware is likely distributed via phishing attacks against users who are seeking to install GlobalProtect. Once the malware is installed, it poses as a company VPN portal while it conducts malicious activities.
“Written in C#, this malware boasts a range of capabilities, including the ability to execute remote PowerShell commands, download and execute additional payloads, and exfiltrate specific files from the infected machine,” the researchers write. “These functions highlight the malware's potential to cause significant damage and disruption within targeted organizations.”
Trend Micro says organizations should implement the following security best practices to defend against these attacks:
- “User awareness and training: Conducting regular training sessions on the various types of social engineering attacks, providing updates on new tactics and trends in social engineering, and educating employees to recognize common red flags can help prevent users from falling victim to social engineering lures
- Principle of least privilege: Granting employees access only to the data and systems they need for their roles minimizes the chance of attackers gaining access to vital information even during a successful breach
- Email and web security: Organizations should deploy robust email and web security solutions to filter and block malicious and suspicious content
- Incident response plan: A well-defined incident response plan is crucial for organizations to be able to handle social engineering attacks. This includes the immediate steps to contain and mitigate the threat”
New-school security awareness training can give your organization an essential layer of defense against social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Trend Micro has the story.
Here's how it works:
