CVs, the perfect tool to deliver malware

guest · Sep 13, 2019

CVs, the perfect tool to deliver malware
September 13, 2019
https://www.pandasecurity.com/mediacenter/security/cvs-malware-phishing/

Cybercriminals have a litany of techniques to get onto their victims’ IT systems: vulnerabilities, social networks, and even snail mail. The most popular method, however, is email: according to sources in the sector, 91% of cybercrime starts with a phishing email.
Quasar: a new version of a popular tactic
Towards the end of August, security researchers discovered a new phishing campaign that uses a particularly deceitful method to get malware onto a company’s system: the malware comes hidden in CVs that are sent as attachments, supposedly from someone looking for a job in the organization.

On the one hand, they can help enormously to streamline the selection process. On the other hand, they have some glaring weak points, among which is IT security. Cybercriminals take advantage of the fact that companies receive dozens of documents related to their selection processes to send documents containing malware.
Click to expand...

guest · Mar 19, 2020

TA505 Targets HR Departments with Poisoned CVs
March 19, 2020
https://www.darkreading.com/attacks...departments-with-poisoned-cvs-/d/d-id/1337355

A newly discovered attack campaign by the notoriously prolific TA505 cybercrime organization now is targeting businesses in Germany via their human resources executives.

Researchers at Prevailion, a security monitoring firm, today detailed the cybercrime group's latest campaign, a business email compromise–style phishing email with Trojanized curriculum vitae files
Once the rigged file is open, the attackers deploy commercial tools to mask their movements, including the NetSupport Manager remote control administration software for intel-gathering and data theft, Google Drive for hosting their hacking tools, and the GPG encryption tool as a ransomware weapon.

According to Prevailion, the attack campaign has been operating since at least April 2018.
Click to expand...

G Drive
The attackers also have been hosting their tools on a Google Drive account to grab NetSupport to steal files, take screenshots, and remotely turn on the infected machine's microphone to listen in.

Like most advanced cybercrime gangs, TA505's M.O. has similarities to those of nation-state groups. "They're not categorized as an APT [advanced persistent threat] but ... there seems to be unique cross-pollination in some of the TTPs [tactics, techniques, and procedures]," says Karim Hijazi, founder and CEO of Prevailion.
Click to expand...

Prevailion: The Curious Case of the Criminal Curriculum Vitae

In this newly discovered campaign from TA505, threat actors targeted German companies with trojanized emails disguised as job applicants. While this activity appeared to be geographically based in Germany, these same techniques could easily be applied to any organization.

Threat actors have continued to rely upon business email compromise (BEC) to initially infect their victims. This technique is particularly hard to defend against when malicious emails mimic normal business interactions. In this particular case the threat actor impersonated an applicant who sought a job and attached a trojanized version of a Curriculum Vitae (or CV).
Click to expand...

guest · Jun 4, 2020

ZLoader-Laced Emails Masquerade As CVs From Job-Seekers
June 4, 2020
https://threatpost.com/zloader-laced-emails-unemployed-victims/156222/

Cybercriminals are taking advantage of the massive uptick in unemployment across the U.S. in a recent spear-phishing campaign, which purports to be CVs sent from job-seekers – but actually spreads banking credential-stealing malware.
The files, attached in Microsoft Excel format, were sent via email with subject lines such as: “applying for a job” or “regarding job.” As victims opened the attached files, they were asked to “enable content.”

ZLoader is a banking malware designed to steal credentials and other private information from users of targeted financial institutions.
The malware can also steal passwords and cookies stored in victim’s web browsers.

“With the stolen information in hand, the malware can allow threat actors to connect to the victim’s system and make illicit financial transactions from the banking user’s legitimate device,” said Check Point researchers, in a Thursday post.
Click to expand...

Log in or Sign up

CVs, the perfect tool to deliver malware

guest Guest

guest Guest

guest Guest

Log in or Sign up

CVs, the perfect tool to deliver malware

guest Guest

guest Guest

guest Guest

Useful Searches