The Kutaki Malware Bypasses Gateways to Steal Users’ Credentials
January 21, 2019 by Darrel Rendell in Threat IntelligenceCISO Summary It’s a case of hiding in plain sight. CofenseTM recently found a phishing campaign that hides the Kutaki malware in a legitimate application to bypass email gateways and harvest users’ credentials.
Phishing Campaigns are Manipulating the Windows Control Panel Extension to Deliver Banking Trojans
January 17, 2019 by Cofense in Threat IntelligenceBy Aaron Riley and Marcel Feller CISO Summary Recently, CofenseTM has seen phishing campaigns that bypass email security using a .cpl file extension attachment. .CPL is the file name extension for items or icons appearing in the Windows Control Panel. These file extensions are vital for most Control Panel tools to function, making endpoint threat mitigation extremely difficult. After evading controls and successfully executing on the endpoint, the .cpl file downloads a second-stage payload, which is typically a banking trojan. According to Cofense IntelligenceTM, most of these phishing campaigns are aimed at South American inboxes. As part of security awareness training...
Exploiting an Unpatched Vulnerability, the Ave_Maria Malware Is Not Full of Grace
January 10, 2019 by Max Gannon in Threat IntelligenceCISO Summary CofenseTM has seen a rise in phishing campaigns designed to deliver a type of stealer malware called Ave_Maria. It contains a capability, DLL hijacking, that uses a vulnerability with no forthcoming fix. With origins in a publicly available utility, DLL lets Ave_Maria gain greater admin privileges and avoid detection, then steal information so it can download additional plugins and potentially other payloads. This malware can bypass detection and privilege restrictions on many endpoints.
The Vjw0rm Malware Does It All. Here’s What to Watch For.
January 9, 2019 by Aaron Riley in Threat IntelligenceCISO Summary It’s called the Vengeance Justice Worm (Vjw0rm), but think of it as the Leatherman tool of malware. Vjw0rm wreaks havoc in highly versatile ways: information theft, denial of service (DoS) attacks, and self-propagation to name a few. CofenseTM has spotted this hybrid threat—a cross between a worm and a remote access trojan (RAT)—in a recent phishing campaign dangling a banking lure.
In 2018, Cheap and Easy Malware Flooded Corporate Inboxes
January 8, 2019 by Darrel Rendell in Threat IntelligenceCISO Summary Sometimes it’s the simple things that make life hard. In 2018, over 2/3 of unique malware campaigns Cofense IntelligenceTM observed were simple, inexpensive “stealers” or remote access trojans (RATs). With exceptionally low barrier-to-entry—an email account or website can handle distribution and communication—these malware types make data theft a viable career choice for threat actors without the skills to use more advanced varieties. Why is this a problem? Though complex malware like Geodo and TrickBot are harder to defend against, simple still works. If it didn’t, threat actors wouldn’t go back to the well again and again. A properly...
Threats of Terror Pervade Recent Extortion Phishing Campaigns
December 20, 2018 by Cofense in Phishing Defense CenterBy Lucas Ashbaugh “There is an explosive device (tronitrotoluene) in the building where your business is conducted […] there will be many victims if it explodes”
5 Things We Launched this Year to Stop Phishing Attacks Faster
December 17, 2018 by John Fitzgerald in PhishingMerry Phishmas! It’s been another busy year of phishing scams, malware delivery, and other Grinchy activity. To help keep you protected, Cofense™ has refined our solutions to stop phishing in its tracks. Following are some of the new capabilities we launched in 2018.
Domain Fronting, Phishing Attacks, and What CISOs Need to Know
December 13, 2018 by Aaron Riley in Threat IntelligenceCISO Summary Cofense IntelligenceTM is seeing continued use of a cyber-attack technique known as domain fronting. It’s yet another way hackers conceal their malicious activity, in this case using work-arounds to evade security controls and gain access to command-and-control (C2) infrastructure (scroll down for a technical explanation). Cozy Bear, the Russian threat actors, used similar tactics when they hacked the Democratic National Committee in 2016. Today, businesses are dealing with phishing and malware attacks that domain fronting enables. While Google and Amazon have taken measures in their CDNs to curtail this trend, we have seen an uptick in C2 infrastructure...
TV-License Phishing Scam Tricks UK Users Into Giving Personal Information
December 5, 2018 by Milo Salvia in Threat IntelligenceCofense Intelligence™ recently observed a new phishing scam making the rounds in the United Kingdom. It poses as the TV licensing authority better known as the British Broadcasting Corporation. The premise behind the scam is to trick the user into believing that he or she is breaking the law by not owning a valid license to receive TV, a criminal offense in the UK with a maximum penalty of a £1000 fine plus any legal costs incurred during prosecution.
2018: A Reverse-Course for Ransomware
December 5, 2018 by Cofense in Threat IntelligenceBy Mollie MacDougall The overall number of ransomware campaigns and active families has declined precipitously in 2018 as compared to last year, almost certainly due to multiple deterrents and a better alternative for profit-minded hackers. This reverse-course in ransomware trends follows years of sustained growth in the number of ransomware families and unique campaigns. Still, ransomware attacks make headlines and will likely continue into next year.