Researchers at Proofpoint have found a a latest Ursnif banking malware used by a hacking group called TA544 which is attacking companies in Italy. Cybersecurity experts found 20 major campaigns providing harmful messages directed towards Italian organizations.
TA544 is a threat actor working for financial purposes, it has been active since 2017, the group targets attacks on banking users, aggravating banking trojans and different payloads to compromise companies across the world, primarily in Italy and Japan. Experts observed that from the time period between January and August 2021, total number of identified Ursnif campaigns affecting Italian companies, was almost equal to the number of Ursnif campaigns attacks in Italy in 2020.
"Today’s threats – like TA544’s campaigns targeting Italian organizations – target people, not infrastructure. That’s why you must take a people-centric approach to cybersecurity. That includes user-level visibility into vulnerability, attacks and privilege and tailored controls that account for individual user risk," suggests concludes Proofpoint.
TA544 threat actor uses social engineering techniques and phishing to attract victims into clicking macro present in weaponized docs. Once the macro is enabled, the malware process starts. If we look into recent attacks against Italian companies, the threat actor impersonated an energy company or an Italian courier, scamming victims via payments.
These spams use weaponized office docs to deploy Ursnif banking malware in the last stage. While investigating these campaigns, TA544 used geofencing methods to find if we're targeted in geographic areas before attacking them with the malware. If the user wasn't in the target area, the malware C2C would direct it to an adult site. As of now in 2021, experts have found around five lakhs messages related with the malware campaigns. The threat actor used file injectors to deploy malicious codes used to steal personal user data like login credentials and banking details.
The research of web injections used by hacking groups reveals that hackers were also trying to steal website credentials with related to major sellers.
Proofpoint reports "recent TA544 Ursnif campaigns included activity that targeted multiple sites with web injects and redirections once the Ursnif payload was installed on the target machine. Web injects refer to malicious code injected to a user’s web browser that attempts to steal data from certain targeted websites. The list included dozens of targeted sites."
