Kimsuky was discovered by Google Mandiant researchers to have deployed spear-phishing attacks involving contract lures with U.S. defense contractors redirecting to fraudulent login pages spoofing those of a telecommunications firm and an email services provider that sought to exfiltrate Diehl Defence employee credentials.
Attackers distributed phishing emails with malicious file download links to facilitate compromise with SnipBot, which includes support for more commands than the previous iteration of RomCom RAT.
Intrusions by Kimsuky involved the delivery of spear-phishing emails luring ZIP file downloads and malicious file extraction to facilitate the deployment of the payloads, which are suspected to be of the same author due to source code similarities.
Attacks commence with the distribution of malicious emails purporting to be an Office 365 alert luring recipients to cancel a request for inbox email deletion through a button that contains the TikTok URL, according to a Cofense Phishing Defense Center analysis.
Attacks conducted until July involved the delivery of phishing messages with malicious shortcut attachments or Google Drive URLs to mainly distribute the Lumma Stealer, NetSupport, and StealC payloads, according to a Proofpoint analysis.
The way we use browsers has changed, so has the way we need to secure them. Using a secure enterprise browser to execute content away from the endpoint, inside a secure cloud browser is a dramatically more effective and cost-effective approach to protect users and secure access. This segment is sponsored by Menlo Security. Visit https://securitywee...
Fast Five
Selected by the SC Media Editorial team every Tuesday.
Sign up now for the top five issues cybersecurity pros need to know this week.
