IKEA email systems hit by ongoing cyberattack

guest · Dec 6, 2021

November 26, 2021

IKEA is battling an ongoing cyberattack where threat actors are targeting employees in internal phishing attacks using stolen reply-chain emails.

A reply-chain email attack is when threat actors steal legitimate corporate email and then reply to them with links to malicious documents that install malware on recipients' devices.
As the reply-chain emails are legitimate emails from a company and are commonly sent from compromised email accounts and internal servers, recipients' will trust the email and be more likely to open the malicious documents.
Click to expand...

IKEA dealing with an ongoing attack
In internal emails seen by BleepingComputer, IKEA is warning employees of an ongoing reply-chain phishing cyber-attack targeting internal mailboxes. These emails are also being sent from other compromised IKEA organizations and business partners.

"There is an ongoing cyber-attack that is targeting Inter IKEA mailboxes. Other IKEA organisations, suppliers, and business partners are compromised by the same attack and are further spreading malicious emails to persons in Inter IKEA," explained an internal email sent to IKEA employees and seen by BleepingComputer.
Click to expand...

Attack used to spread Emotet or Qbot trojan
From the URLs shared in the redacted phishing email above, BleepingComputer has been able to identify the attack targeting IKEA.

When visiting these URLs, a browser will be redirected to a download called 'charts.zip' that contains a malicious Excel document. This attachment tells recipients to click the 'Enable Content' or 'Enable Editing' buttons to properly view it, as shown below.
Click to expand...

Due to the severity of these infections and the likely compromise of their Microsoft Exchange servers, IKEA is treating this security incident as a significant cyberattack that could potentially lead to a far more disruptive attack.
Click to expand...

Log in or Sign up

IKEA email systems hit by ongoing cyberattack

guest Guest

Log in or Sign up

IKEA email systems hit by ongoing cyberattack

guest Guest

Useful Searches