Hackers attacking corporate executive targets with personalized phishing emails

Ccleaner
Security firm Proofpoint reports that a “financially motivated threat actor” it calls TA530 is currently targeting company executives and additional high-level employees in an unusually personalized spear phishing campaign. It’s targeting individuals with high-ranking roles such as chief financial officer and senior vice president using emails containing their specific names, job titles, phone numbers, and more within the email body.

A spear phishing campaign doesn’t send out emails to a general audience hoping to reel in a few victims, but typically focuses on a specific organization in order to hook individuals into giving up confidential information such as military data or trade secrets. The emails appear to derive from a trusted source, and contain a link to a fake malware-infested Web page or a file that downloads malicious software.

Proofpoint says the information used by TA530 can be gathered from public sites like the company’s own website, LinkedIn, and so on. It’s targeting up to tens of thousands of individuals located in organizations based in the United States, the United Kingdom, and Australia. The attacks are even larger than other spear phishing campaigns, but have yet to approach the magnitude of Dridex and Locky.

TA530 is mostly targeting financial services, followed by organizations in retail, manufacturing, health care, education, and business services. Technology-focused organizations are also affected along with insurance companies, utility services, and companies involved in entertainment and media. Transportation is the lowest on the list of targets.

TA530 carries a number of playloads in its arsenal, including a banking Trojan, a Point of Sale reconnaissance Trojan, a downloader, file-encrypting ransomware, a banking Trojan botnet, and more. For instance, the Point of Sale reconnaissance Trojan is mostly used in a campaign against retail and hospitality companies, and financial services. The banking Trojan is configured to attack banks located throughout Australia.

In a sample email provided in the report, Proofpoint shows that TA530 is attempting to infect the manager of a retail company. This email includes the target’s name, the company name, and the phone number. The message requests that the manager fill out a report regarding an incident that took place at one of the actual retail locations. The manager is to open the document, and if macros are enabled, it will infect his computer by downloading the Point of Sale Trojan.

In the few cases presented by Proofpoint, the targeted individuals receive an infected document although the security firm states that these emails can also contain malicious links and attached JavaScript downloaders. The company has also seen a few emails in the TA530-based campaigns that were not personalized, but still carried the same consequences.

“Based on what we have seen in these examples from TA530, we expect this actor to continue to use personalization and to diversify payloads and delivery methods,” the firm states. “The diversity and nature of the payloads suggest that TA530 is delivering payloads on behalf of other actors. The personalization of email messages is not new, but this actor seems to have incorporated and automated a high level of personalization, previously not seen at this scale, in their spam campaigns.”

Unfortunately, Proofpoint believes that this personalization technique isn’t limited to TA530, but will ultimately be used by hackers as they learn to pull corporate information from public websites such as LinkedIn. The answer to this problem, according to Proofpoint, is end-user education and a secure email gateway.

Computing

The Surface Centaurus might run Android apps, but is that a good idea?

A new leak hints that Microsoft's rumored Project Centaurus is a dual-screen device that will run Android apps. Is this what Microsoft needs to save its desperately-ignored Windows tablet mode?
Deals

Walmart, Target, and other retailers compete with Amazon’s 48 hour Prime Day

When the news dropped that Amazon's Prime Day 2019 sales extravaganza begins July 15 and lasts 48 hours through July 16, competitors had no choice but to respond. Online retailers will either compete or fall behind.
Mobile

A library at your fingertips: The best free Kindle books

Reading shouldn't be an expensive hobby. Here, we've put together a list of some of the better free offerings currently available for Kindle devices, so you don't have to sort through thousands of titles on Amazon and Google Play.
Mobile

From true crime to comedy, here's our list of the best podcasts around

When you aren’t in the music mood, podcasts can be your ear candy. Whether you love to stay up-to-date on the latest news or want to know what’s happening in sports, you’ll find something on our must-listen-to podcast roundup.
Movies & TV

The best movies streaming on Hulu right now (June 2019)

From dramas to blockbusters, Hulu offers some great films to its subscribers. Check out the best movies on Hulu, whether you're into charming adventure tales or gruesome horror stories.
Photography

Create apocalyptic A.I. world with this camera app that removes people from pics

What would the shots in your camera roll look like without any people? Bye Bye Camera is a new iOS app that uses artificial intelligence to remove all people from the photo., but it's not designed for practical applications.
Product Review

The 13-inch Acer Swift 3 struggles to find a place in a very crowded market

Acer’s 13-inch version of the Swift 3 clamshell laptop doesn’t offer much to distinguish itself from a very crowded market. It’s not faster, cheaper, better-built, or more attractive than the competition.
Computing

A dual-screen device from Microsoft is in the works. Here's what we know so far

Would you be interested in a dual-screen Surface computer? The Surface Centaurus is a Microsoft project working on just that -- and Microsoft already has a prototype. Here's all the important information on Centaurus!
Computing

MacOS Catalina is a worthy update but leaves us worried about the Mac's future

The public beta of Apple’s MacOS Catalina is here, and we’ve got our first impressions of Apple’s latest operating system to see if the new features are worth the hype.
Computing

All the news, rumors and wishes for Microsoft's Surface Book 3

Want to know more about Microsoft's Surface Book 3? Here's what we know about the third-generation Surface Book, including what's likely to change, when it will be released, and more useful information!
Mobile

The best travel power adapters for international jet-setters

We recently tried out several of the best travel adapters on our journeys around the globe, and these are our favorite models so far. If you want to keep your gadgets juiced on the go, then snag one of these.
Photography

After Lightroom and Photoshop, Loupedeck brings tactile edits to Camera RAW

Loupedeck, the photo-editing keyboard, can now work round-trip for editing a photo in Lightroom, Adobe Camera RAW, and Photoshop. The new Camera RAW integration continues to add to the Loupedeck Plus roster of compatible software.
Deals

Pre-Prime Day Deal: Amazon has the best offer on the 13-inch MacBook Pro

Prime Day is less than three weeks away, but we’ve already seen some sweet Apple discounts popping up lately. If you're hungry for a deal before Prime Day, Amazon has the 13.3-inch MacBook Pro on sale right now for a nice $200 discount.
Emerging Tech

A Netflix data scientist taught an A.I. to recognize smooching scenes in movies

A senior data scientist at Netflix has taught an A.I. algorithm to recognize kissing scenes in movies. Here's why it could turn out to be a very useful tool for the future of moviemaking.