Bellingcat journalists targeted by failed phishing attempt

guest · Jul 27, 2019

Bellingcat journalists targeted by failed phishing attempt
Sophisticated operation against ProtonMail accounts
July 27, 2019
https://techcrunch.com/2019/07/27/bellingcat-targeted-failed-phishing-attempt/

Investigative news site Bellingcat has confirmed several of its staff were targeted by an attempted phishing attack on their ProtonMail accounts, which the journalists and the email provider say failed.

“Yet again, Bellingcat finds itself targeted by cyber attacks, almost certainly linked to our work on Russia,” wrote Eliot Higgins, founder of the investigative news site in a tweet. “I guess one way to measure our impact is how frequently agents of the Russian Federation try to attack it, be it their hackers, trolls, or media.”
A phishing email purportedly from ProtonMail itself asked users to change their email account passwords or generate new encryption keys through a similarly-named domain set up by the attackers. Records show the fake site was registered anonymously, according to an analysis by security researchers.
In a statement, ProtonMail said the phishing attacks “did not succeed” and denied that its systems or user accounts had been hacked or compromised.

Yen said the attackers tried to exploit an unpatched flaw in third-party software used by ProtonMail, which has yet to be fixed or disclosed by the software maker.

“This vulnerability, however, is not widely known and indicates a higher level of sophistication on the part of the attackers,” said Yen.
Click to expand...

ThreatConnect: Building Out ProtonMail Spoofed Infrastructure with Creation Timestamp Pivoting
ProtonMail: Statement on the attempted phishing attack against Bellingcat

guest · Aug 11, 2019

Long read
Guccifer Rising? Months-Long Phishing Campaign on ProtonMail Targets Dozens of Russia-Focused Journalists and NGOs
August 10, 2019
https://www.bellingcat.com/news/uk-...ozens-of-russia-focused-journalists-and-ngos/

A sophisticated phishing campaign targeting Bellingcat and other Russia-focused journalists has been much larger in scope than previously thought, and has lasted at least several months.
The one common denominator among them is the Russian focus of their research or activist work. Contrary to previous reporting, we have identified that at least some of the phishing attempts have been successful.

While the initial assumption was that the operation had tried to steal log-in credentials, the volume and complexity of the Javascript code used by the phishing sites has raised the possibility that there may have been additional nefarious activity proactively performed by the script without the user’s knowledge or interaction. [...]
A State Actor
Our preliminary analysis of the source code used on the phishing sites implies that the campaign was the work of a state actor and not of an individual hacker or a hacker collective.
One indirect reason for attribution to a state actor is the time that it required to build (or re-purpose) the code and infrastructure for the operation.
Click to expand...

Log in or Sign up

Bellingcat journalists targeted by failed phishing attempt

guest Guest

guest Guest

Log in or Sign up

Bellingcat journalists targeted by failed phishing attempt

guest Guest

guest Guest

Useful Searches