Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Fake Website. Show all posts
Windows
Cyber Attacks Fake Website Firefox RomCom Windows

Russian Hackers Use Firefox and Windows Vulnerabilities in Global Cyberattack

 



A sophisticated cyberattack carried out by the Russian cyber threat group RomCom APT has raised alarms within the global cybersecurity community. Exploiting two previously unknown zero-day vulnerabilities in Firefox and Windows, the attack, which took place in October, was able to infiltrate systems without any user interaction. This tactic marks a concerning escalation in cyberattack methods, highlighting the ever-growing sophistication of threat actors. 
 

How the Attack Unfolded 

 
RomCom APT used two critical vulnerabilities to carry out its campaign: 
 
1. Firefox Animation Timeline Vulnerability (CVE-2024-9680) 
 
A severe flaw in Firefox's animation timelines allowed the attackers to remotely execute malicious code. Rated 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), the vulnerability was exploited through fake websites. Victims who visited these websites unknowingly downloaded malware disguised as the RomCom backdoor. Once installed, the malware silently redirected users to the legitimate websites they intended to visit, leaving them unaware of the compromise. This vulnerability also affected Tor, which shares a code base with Firefox, broadening its potential impact. 

2. Windows Task Scheduler Vulnerability (CVE-2024-49039) 
 
The second vulnerability resided in the Windows Task Scheduler, with a CVSS score of 8.8. This flaw allowed the attackers to bypass the security sandbox of the browser, escalating privileges and providing them with full access to the victim's system. With this level of control, RomCom hackers were able to execute further malicious activities undetected. 

 
Targets and Techniques 

 
RomCom APT deployed fake websites posing as well-known platforms, including ConnectWise, Devolutions, and Correctiv, to lure victims. The group targeted high-value sectors such as **insurance**, pharmaceuticals, defense, energy, and government institutions, with the majority of victims located in North America and Europe, particularly in Germany, France, and the United States. 
 
RomCom is notorious for combining cybercrime with politically motivated espionage. This attack is part of a broader pattern targeting politically and economically sensitive sectors. Prompt responses from cybersecurity teams, including collaboration with security experts, helped prevent the attack from spreading widely, limiting its impact. 
 

Swift Vulnerability Patching 
 

Fortunately, both vulnerabilities were addressed promptly. Mozilla released a patch for the Firefox flaw on October 9, just 25 hours after it was notified. Similarly, Microsoft issued a patch for the Windows vulnerability on November 12. These swift responses underscore the importance of keeping systems updated, as timely patches are often the first line of defense against zero-day vulnerabilities. 

 
Cybersecurity Takeaways 

 
This attack serves as a stark reminder of the necessity for robust software maintenance and a proactive patch management strategy. Zero-day vulnerabilities are often exploited rapidly, making regular updates crucial for minimizing the risk of exploitation. While the RomCom attack was relatively short-lived, it underscores the evolving nature of cyber threats. Organizations and individuals alike must stay vigilant, prioritize timely software updates, and adopt comprehensive cybersecurity measures to protect against increasingly sophisticated attacks.   
 

Key Points for Cybersecurity Practitioners: 

  • Maintain Updated Software: Regular updates and patches are essential to protecting against zero-day vulnerabilities. 
  • Awareness of Emerging Threats: Understand and mitigate the risks associated with zero-click attacks and other advanced persistent threats. 
  • Strengthen Incident Response: Timely detection and rapid response are critical to minimizing the impact of cyberattacks.
Read more »
User Security
Bing Ad Cyber Fraud Fake Website Malicious Sites Trojan User Security

Bing Ad Posing as NordVPN Aims to Propagate SecTopRAT Malware

 

A Bing advertisement that appeared to be a link to install NordVPN instead led to an installer for the remote access malware SecTopRAT. 

Malwarebytes Labs identified the malvertising campaign on Thursday, with the domain name for the malicious ad having been registered only a day earlier. The URL (nordivpn[.]xyz) was intended to resemble an authentic NordVPN domain. The ad link linked to a website with another typosquatted URL (besthord-vpn[.]com) and a duplicate of the actual NordVPN website.

The download button on the fake website directed to a Dropbox folder containing the installer NordVPNSetup.exe. This executable comprised both an authentic NordVPN installation and a malware payload that was injected into MSBuild.exe and connected to the attacker's command-and-control (C2) server.

The threat actor attempted to digitally sign the malicious programme, however the signature proved to be invalid. However, Jérôme Segura, Principal Threat Researcher at Malwarebytes ThreatDown Labs, told SC Media on Friday that he discovered the software had a valid code signing certificate. 

Segura said some security products may block the executable due to its invalid signature, but, “Perhaps the better evasion technique is the dynamic process injection where the malicious code is injected into a legitimate Windows application.” 

“Finally, we should note that the file contains an installer for NordVPN which could very well thwart detection of the whole executable,” Segura added. 

The malicious payload, SecTopRAT, also known as ArechClient, is a remote access trojan (RAT) identified by MalwareHunterTeam in November 2019 and then analysed by GDATA experts. The researchers discovered that the RAT produces an "invisible" second desktop, allowing the attacker to manage browser sessions on the victim's PC. 

SecTopRAT can also provide system information, such as the system name, username, and hardware, to the attacker's C2 server. 

Malwarebytes reported the malware campaign to both Microsoft, which controls Bing, and Dropbox. Dropbox has since deactivated the account that contained the malware, and Segura said his team had yet to hear anything from Microsoft as of Friday. 

“We did notice that the threat actors updated their infrastructure last night, perhaps in reaction to our report. They are now redirecting victims to a new domain thenordvpn[.]info which may indicate that the malvertising campaign is still active, perhaps under another advertiser identity,” Segura concluded. 

Other malvertising efforts promoting SecTopRAT have been discovered in the past. In 2021, Ars Technica reported on a campaign that used Google advertisements to promote the Brave browser.

Last October, threat actors employed malvertising, search engine optimisation (SEO) poisoning, and website breaches to deceive consumers into installing a fake MSIX Windows programme package containing the GHOSTPULSE malware loader. Once deployed, GHOSTPULSE employs a process doppelganging to enable the execution of several malware strains, including SecTopRAT.
Read more »
phishing
Cyber Security E-Commerce Fake Website Online Shopping phishing

E-Commerce Scam: Read These 5 Tips to Stay Safe from Fake Sites

scam

The e-commerce industry has witnessed tremendous growth in the last decade, and it's likely to rise. Tech behemoths like Apple lead the market, but most businesses these days sell goods and services online, including local stores.

Not only has it changed the way of doing business, but e-commerce has also caused a rapid change in shopping consumer habits. Today, buying what you need is just a click away, you can shop from the comfort of your home, that's the trend now. It is evident that online shopping provides a level of ease that traditional retail can't match, however, e-commerce is without a doubt more risky. 

The e-commerce industry is a hotspot of cyber threats, from phishing attacks to false advertising and credit card skimming scams. As a conscious user, we must know how to protect ourselves. These five helpful tips can help you decide if you're on a fake site before you "add to cart" your favorite product. 

Verify the URL

The URL (Uniform Resource Locator) is the address of a webpage. Hackers make fake sites that look almost the same as the original, they use a domain name that's nearly identical to the site domain they are faking. 

The first thing you should look for is if there are any errors or extra characters in the URL.

For instance, an attacker might make a fake site at flippkartt.com, to scam people into thinking they are using the original Flipkart site. But the real URL will look like "https://flipkart.com/." The URL of the fake site would be "http://flippkartt.com/." You might observe there is a difference in the protocol. The original site uses HTTPS (Hypertext Transfer Protocol Secure), while the fake uses HTTP (Hypertext Transfer Protocol). 

The HTTPS prefix means your data is encrypted in transit, but takes more time and cost to set up, so the scammers don't try. 

In a nutshell, most phishing scams work like this. It all comes down to cloning a real business and stealing sensitive info from users. It is always important to check the URL before you proceed. 

The content and design

A real business website would not have grammatical and spelling mistakes. Few scammers might hustle to proofread the content of their fake site, but not all do that. If you visit a site and notice it has mistakes and typos, chances are it's a scam. 

Similarly, a real business won't publish low-quality images or poor designs. Scammers will do that because they don't have an image to maintain. 

The scammer would scrape photos from the web using software, or just put random images that aren't related to the product. This is your sign to stay away from the fake website. 

Don't fall for too-good-to-be-true offers

The iPhone 15 is currently costing around 72000 INR. Suppose you see the product online selling for 30000 INR, it is most likely a scam. 

It is an easy bait as buyers like to crack deals, and in a rush, fall prey to the scam. Scammers know that huge discounts work as a glue trap for economically struggling buyers. So next time, make sure you see the right price before rushing to "add to cart" on an online shopping website. 

Read the About Us page

A legit e-commerce site will always have an elaborate "About Us" page, the buyer can clearly understand the business's goals, mission, etc. with the help of given info. Sometimes, "About Us" also includes info regarding careers, team members, and ownership. Lastly, there's a detailed privacy policy and a contact form for interested customers and media professionals. 

With time, the scams have upped their games as scammers now use AI to scale their attacks, however only a few bother to make a legit "About Us" page. If you notice that an online shopping site doesn't have these elements, and it's lacking transparency, you should avoid it. Don't spend your money without checking these pages. 

Read the reviews

You should always go through an online store's reviews before buying a product. A legit business will always have a review somewhere. You can start with Google reviews, just type the business name and go to the reviews section. Bingo, you can now check what others say about the store. 

If you can't find even a single review, the store might not be fake, but it's best to avoid it. You can also check what others are saying on social media. Twitter and Reddit are some common sites where users share their experiences. It barely takes a minute, but can save you from a scam. 

Read more »
Technolgy
barcode Data Breach Email Breach Fake Website Malicious Software Multi-Factor Authentication (MFA) Phising Attacks QR code Sensitive Information Technolgy

QR Code Phishing Attacks: A Rising Threat

Leading cybersecurity firms have reported a startling 587% increase in QR code-based phishing assaults in recent times. This concerning pattern demonstrates how fraudsters are changing their strategies to take advantage of people's confidence in QR codes for a variety of objectives.

QR codes, initially designed for convenience and efficiency, have become an integral part of our digital lives. From accessing websites to making payments, these two-dimensional barcodes have streamlined numerous processes. However, this surge in phishing attacks signifies that cybercriminals are adapting and finding innovative ways to exploit this technology.

Cybersecurity experts have identified several strategies employed by attackers in these QR code phishing campaigns. One common tactic involves distributing malicious QR codes via emails or social engineering techniques. Unsuspecting victims scan these codes, unwittingly granting cybercriminals access to sensitive information or infecting their devices with malware.

Furthermore, attackers are increasingly using QR codes in conjunction with fake landing pages that mimic legitimate websites. These convincing replicas deceive users into entering their credentials or personal information, which is then harvested by the attackers. This method has proven to be highly effective, as even cautious individuals can be easily tricked by sophisticated phishing pages.

To combat this rising threat, experts emphasize the importance of user education and awareness. Individuals should exercise caution when scanning QR codes, especially if received from unknown or unverified sources. Employing reputable security software that includes QR code scanning capabilities can also provide an additional layer of protection.

Additionally, businesses and organizations should implement multi-factor authentication measures and conduct regular security audits to identify and mitigate potential vulnerabilities. By staying vigilant and adopting proactive cybersecurity measures, individuals and businesses can help curb the success of QR code phishing attacks.

The surge in QR code-based phishing attacks serves as a stark reminder of the ever-evolving landscape of cyber threats. As technology advances, so do the tactics of cybercriminals. Vigilance, education, and robust cybersecurity practices are crucial in safeguarding against these sophisticated attacks.






Read more »
Spoofing Attack
Chinese Chinese Actors Cyber Security Fake Website fake websites Misinformation Spoofing Spoofing Attack

Smash and Grab: Meta Takes Down Disinformation Campaigns Run by China and Russia

 

Meta, Facebook’s parent company has confirmed that it has taken down two significant but unrelated ‘disinformation operations’ rolling out from China and Russia. 

The campaigns began at the beginning of May 2022, targeting media users in Germany, France, Italy, Ukraine, and the UK. The campaign attempted to influence public opinions by pushing fake narratives in the west, pertaining to US elections and the war in Ukraine. 

The campaign spoofed around 60 websites, impersonating legitimate news websites, such as The Guardian in the UK and Bild and Der Spiegel in Germany. The sites did not only imitate the format and design of the original news sites but also copied photos and bylines from the news reporters in some cases. 

“There, they would post original articles that criticized Ukraine and Ukrainian refugees, supported Russia, and argued that Western sanctions on Russia would backfire […] They would then promote these articles and also original memes and YouTube videos across many internet services, including Facebook, Instagram, Telegram, Twitter, petitions websites Change.org and Avaaz, and even LiveJournal” Meta stated in a blog post. 

In the wake of this security incident, Facebook and Instagram have reportedly removed nearly 2,000 accounts, more than 700 pages, and one group. Additionally, Meta detected around $105,000 in advertising. While Meta has been actively quashing fake websites, more spoofed websites continue to show up.  

However, “It presented an unusual combination of sophistication and brute force,” claims Meta’s Ben Nimmo and David Agranovich in a blog post announcing the takedowns. “The spoofed websites and the use of many languages demanded both technical and linguistic investment. The amplification on social media, on the other hand, relied primarily on crude ads and fake accounts.” 

“Together, these two approaches worked as an attempted ‘smash-and-grab’ against the information environment, rather than a serious effort to occupy it long term.” 

Both the operations are now taken down as the campaigns were a violation of Meta’s “coordinated inauthentic behaviour” rule, defined as “coordinated efforts to manipulate public debate for a strategic goal, in which fake accounts are central to the operation”. 

Addressing the situation of emerging fraud campaigns, Ben Nimmo further said, “We know that even small operations these days work across lots of different social media platforms. So the more we can share information about it, the more we can tell people how this is happening, the more we can all raise our defences.”
Read more »
malware
Discord Fake Website Gaming Community Gaming Malware malware

Hackers Make Fake Cthulhu Website to Distribute Malware


Fake Cthulhu website spreads malware 

Threat actors have made a fake 'Cthulhu World ' play-to-earn community, this includes websites, social accounts, a medium developer site, and Discord groups to spread the Raccoon stealer, AsyncRAT, and Redline password stealing malware on innocent targets.

As play-to-earn communities have risen in popularity, threat actors and scammers constantly attack these new platforms for suspicious activities. 

The same applies to a new malware distribution campaign found by cybersecurity expert "iamdeadlyz", where hackers made an entire project to advertise a fake play-to-earn game known as Cthulhu World.

Hackers promote the fake project 

To publicize the 'project,' hackers send direct messages to users on Twitter asking if they wish to perform a test of their new game. In return of testing and promoting the game, the hackers promise of rewarding in Ethereum. 

When a user visits cthulhu-world.com site (currently down), users are welcomed with a well designed website, it includes information about the project and an interactive map of the game's environment.

But, it is a fake site which is a copy of the original Alchemic World Project, which has warned its users to stay aware of the fake project. Someone made a fake account for our project, and copied the website, and all social media.

Experts say to "stay away"

"STAY AWAY this account and don't follow them. All their assets were stolen from our project," Tweeted Alchemic World. 

The Cthulhu World website is also different in some ways, for instance, when a user clicks the upper right-hand corner arrow on the website, the site brings them to a webpage requesting a "code" to download the "alpha" test of the project.

The hackers then distribute these codes to potential victims as a part of their DM conversations on Twitter. The access code list can be found on the site's source code. 

3 downloaded files contain the malware 

On the basis of the code entered, one of the three files is downloaded from the DropBox. All of these three files will install different malware, which allows the threat actor to pick and choose how they want to attack a particular victim. 

The three malware found by AnyRun installs are Raccoon Stealer, AsyncRAT, and RedLine Stealer.

"As RedLine Stealer and Raccoon Stealer are known to steal cryptocurrency wallets, it is not surprising to find that some victims have already had their wallets cleaned out by this scam," says Bleeping Computer.

 
The Cthulhu World Website is currently shut down, but their Discord is up and running. It isn't clear if users on this Discord are aware that a website is sharing malware, however, few users have full faith that it is a genuine project.

How to protect yourself?

If you visited Cthulhu-world.com and installed any of their softwares, the user should immediately remove any items found and run an antivirus scan on the system right away.

You should also note that these malware infections can steal your cookies, crypto wallets, and saved passwords, you should reset all passwords and make a new wallet to import all the cryptocurrency.

The best way to protect yourself is to reinstall your system from scratch, as these malware infections give full access to an infected computer, and other suspicious malware can be installed.


Read more »
Subscribe to: Posts (Atom)