Another group is impersonating USPS, tax entities around the globe in order to steal money

guest · Nov 14, 2019

Another group is impersonating USPS, tax entities around the globe in order to steal money
November 14, 2019
https://www.cyberscoop.com/postal-service-phishing-scheme-proofpoint/

A new scheme has seen a nefarious actor impersonating the United States Postal Service and tax entities in recent weeks in an effort to get victims in the U.S., Italy, and Germany to download and install malware, according to new research from Proofpoint.

The scheme has been trying to trick victims into clicking through spearphishing emails that contain ransomware — and at times banking trojans — by sending alerts that appear to require urgent action related to tax information.
[...] The note then urged victims to submit a refund request using an attacker-manipulated Microsoft Word document, which, if opened, would install Maze ransomware to the victim’s system.

The actor repeated this infection chain in another campaign that impersonated the German internet service provider, 1&1 Internet AG, in hundreds of spearphishing emails early this month.
Just this Tuesday the actor has expanded its scheme to include U.S. targets, according to Proofpoint.
Click to expand...

“Based on a number of characteristics and TTPs including sending infrastructure, lure styles, macro code, and more, we have not uncovered any overlap with those of existing actors,” Dawson told CyberScoop.
Proofpoint said it will continue to monitor for campaigns from the new cybercriminal actor.
Click to expand...

Proofpoint: TA2101 plays government imposter to distribute malware to German, Italian, and US organizations

Proofpoint researchers recently detected campaigns from a relatively new actor, tracked internally as TA2101, targeting German companies and organizations to deliver and install backdoor malware.
The actor initiated their campaigns impersonating the Bundeszentralamt fur Steuern, the German Federal Ministry of Finance, with lookalike domains, verbiage, and stolen branding in the emails.

For their campaigns in Germany, the actor chose Cobalt Strike, a commercially licensed software tool that is generally used for penetration testing and emulates the type of backdoor framework used by Metasploit, a similar penetration testing tool.
Click to expand...

Log in or Sign up

Another group is impersonating USPS, tax entities around the globe in order to steal money

guest Guest

Log in or Sign up

Another group is impersonating USPS, tax entities around the globe in order to steal money

guest Guest

Useful Searches