Hacking Group Earth Wendigo Exploits Emails via Spear-phishing Attacks

guest · Jan 9, 2021

Hacking Group Earth Wendigo Exploits Emails via Spear-phishing Attacks
January 9, 2021
https://www.ehackingnews.com/2021/01/hacking-group-earth-wendigo-exploits.html

As per the cybersecurity experts, the cyberattacks are related to Earth Wendigo, a cyber criminal currently not linked to any of the hacking groups. At the start of May 2019, Trend Micro reported that multiple organizations were attacked by Earth Wendigo. The targets include research institutions, government organizations and universities.

Trend Micro reports,

"we discovered a new campaign that has been targeting several organizations — including government organizations, research institutions and universities in Taiwan — since May 2019, aiming to exfiltrate emails from targeted organizations via the injection of JavaScript backdoors to a webmail system that is widely-used in Taiwan. With no clear connection to any previous attack group, we gave this new threat actor the name “Earth Wendigo.”
Click to expand...

Earth Wendigo deployed spear-phishing emails that contained obfuscate Java script code, using initial attack vectors, Java script loaded corrupted scripts from remote servers controlled by attackers. The scripts were built for stealing Webmail session keys and browser cookies, spread the malicious scripts through appending code with the target's email signature, and exploiting an XSS (cross-site scripting) vulnerability in the Javascript injection Webmail server.
Click to expand...

Trend Micro: Earth Wendigo Injects JavaScript Backdoor to Service Worker for Mailbox Exfiltration

The Earth Wendigo threat actor will establish a WebSocket connection between the victims and their WebSocket server via a JavaScript backdoor. The WebSocket server instructs the backdoor on the victim’s browser to read emails from the webmail server and then send the content and attachments of the emails back to the WebSocket server. We will share more details of the attack chain in the following paragraphs.
Conclusion
While Earth Wendigo uses typical spear-phishing techniques to initiate their attack, the threat actor also uses many atypical techniques to infiltrate the targeted organizations, such as the use of mail signature manipulation and Service Worker infection.
Click to expand...

Log in or Sign up

Hacking Group Earth Wendigo Exploits Emails via Spear-phishing Attacks

guest Guest

Log in or Sign up

Hacking Group Earth Wendigo Exploits Emails via Spear-phishing Attacks

guest Guest

Useful Searches