Hackers hijacked a government server to send malware to U.S. companies

hawki · Oct 11, 2017

"Cybercriminals hijacked a government server to send sophisticated malware to U.S. companies

A Eastern European hacking group hijacked U.S. state government servers to dispense malware through phishing emails that were designed to appear like they had come from the Securities and Exchange Commission, according to research by Cisco’s Talos team and an analysis by other cybersecurity experts familiar with the activity

The technical findings connect a known advanced persistent threat (APT) group, codenamed FIN7 by U.S. cybersecurity firm FireEye, to a sophisticated intrusion technique that was detected in a recent wave of spoofed emails that mimicked the SEC’s domain. The messages carried malware-laden Microsoft Word documents mentioning financial disclosure information from the EDGAR system...

Emails tied to this campaign were “highly targeted” and only sent to a small, select group of U.S. businesses in several different industry sectors, including finance, insurance and information technology, said Craig Williams, a senior researcher with Talos..."

https://www.cyberscoop.com/cybercri...ver-send-sophisticated-malware-u-s-companies/

itman · Oct 12, 2017

Hackers Used Government Servers in DNSMessenger Attacks

A recently discovered DNSMessenger campaign is abusing compromised U.S. state government servers to host malware, Cisco Talos security researchers say.

First uncovered in early March, the DNSMessenger attack involved the use of DNS requests to establish communication between a PowerShell RAT and its command and control (C&C) servers. Completely fileless and invisible to most standard defenses, the attack was highly targeted and researchers attributed it to a sophisticated threat actor.

Cisco now says that additional attacks leveraging this type of malware were discovered, targeting several organizations in an attempt to infect them with malware. Specific to this campaign is the use of DNS TXT records to create a bidirectional C&C channel and directly interact with the Windows Command Processor.

The attackers use spear phishing emails to spread the malware and leverage U.S. state government servers to host the malicious code necessary in the later stages of the infection chain. The emails, Cisco reveals, are spoofed to seem as if they were sent from the Securities and Exchange Commission (SEC) Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system.
Click to expand...

http://www.securityweek.com/hackers-used-government-servers-dnsmessenger-attacks

Log in or Sign up

Hackers hijacked a government server to send malware to U.S. companies

hawki Registered Member

itman Registered Member

Log in or Sign up

Hackers hijacked a government server to send malware to U.S. companies

hawki Registered Member

itman Registered Member

Useful Searches