Hackers attacking corporate executive targets with personalized phishing emails

Security firm Proofpoint reports that a “financially motivated threat actor” it calls TA530 is currently targeting company executives and additional high-level employees in an unusually personalized spear phishing campaign. It’s targeting individuals with high-ranking roles such as chief financial officer and senior vice president using emails containing their specific names, job titles, phone numbers, and more within the email body.

A spear phishing campaign doesn’t send out emails to a general audience hoping to reel in a few victims, but typically focuses on a specific organization in order to hook individuals into giving up confidential information such as military data or trade secrets. The emails appear to derive from a trusted source, and contain a link to a fake malware-infested Web page or a file that downloads malicious software.

Proofpoint says the information used by TA530 can be gathered from public sites like the company’s own website, LinkedIn, and so on. It’s targeting up to tens of thousands of individuals located in organizations based in the United States, the United Kingdom, and Australia. The attacks are even larger than other spear phishing campaigns, but have yet to approach the magnitude of Dridex and Locky.

TA530 is mostly targeting financial services, followed by organizations in retail, manufacturing, health care, education, and business services. Technology-focused organizations are also affected along with insurance companies, utility services, and companies involved in entertainment and media. Transportation is the lowest on the list of targets.

TA530 carries a number of playloads in its arsenal, including a banking Trojan, a Point of Sale reconnaissance Trojan, a downloader, file-encrypting ransomware, a banking Trojan botnet, and more. For instance, the Point of Sale reconnaissance Trojan is mostly used in a campaign against retail and hospitality companies, and financial services. The banking Trojan is configured to attack banks located throughout Australia.

In a sample email provided in the report, Proofpoint shows that TA530 is attempting to infect the manager of a retail company. This email includes the target’s name, the company name, and the phone number. The message requests that the manager fill out a report regarding an incident that took place at one of the actual retail locations. The manager is to open the document, and if macros are enabled, it will infect his computer by downloading the Point of Sale Trojan.

In the few cases presented by Proofpoint, the targeted individuals receive an infected document although the security firm states that these emails can also contain malicious links and attached JavaScript downloaders. The company has also seen a few emails in the TA530-based campaigns that were not personalized, but still carried the same consequences.

“Based on what we have seen in these examples from TA530, we expect this actor to continue to use personalization and to diversify payloads and delivery methods,” the firm states. “The diversity and nature of the payloads suggest that TA530 is delivering payloads on behalf of other actors. The personalization of email messages is not new, but this actor seems to have incorporated and automated a high level of personalization, previously not seen at this scale, in their spam campaigns.”

Unfortunately, Proofpoint believes that this personalization technique isn’t limited to TA530, but will ultimately be used by hackers as they learn to pull corporate information from public websites such as LinkedIn. The answer to this problem, according to Proofpoint, is end-user education and a secure email gateway.

Product Review

Fascinating Finney phone is crypto in a nutshell: Exciting, but also terrifying

The Sirin Labs Finney phone is to cryptocurrency what the iPhone is to Apple Pay. It facilitates the payment, processing, and exchanging of cryptocurrencies on a smartphone, and surprisingly does it in a user-friendly way.

Your PlayStation 4 game library isn't complete without these games

Looking for the best PS4 games out there? Out of the massive crop of titles available, we selected the best you should buy. No matter what your genre of choice may be, there's something here for you.
Movies & TV

The best shows on Netflix, from 'Haunting of Hill House’ to ‘Norsemen’

Looking for a new show to binge? Lucky for you, we've curated a list of the best shows on Netflix, whether you're a fan of outlandish anime, dramatic period pieces, or shows that leave you questioning what lies beyond.

These are the 6 best free antivirus apps to help protect your MacBook

Malware protection is more important than ever, even if you eschew Windows in favor of Apple's desktop platform. Thankfully, protecting your machine is as easy as choosing from the best free antivirus apps for Mac suites.

Chrome is a fantastic browser, but is is still the best among new competitors?

Choosing a web browser for surfing the web can be tough with all the great options available. Here we pit the latest versions of Chrome, Opera, Firefox, Edge, and Vivaldi against one another to find the best browsers for most users.

Don't use streaming apps? Try the best free media players for your local music

Rather than using music-streaming apps, you may want something for playing your local music. Good news! There are some good alternatives. These are the best media players you can download for free on Windows.

Need speed? Qualcomm unveils the Snapdragon X55, the world’s fastest 5G modem

Qualcomm is preparing for an even faster future: The silicon giant just unveiled a second generation 5G modem for smartphones, promising blistering download speeds as high as 7Gbps.

Barbie’s Corvette ain’t got nothing on Sphero’s fully programmable robot car

Sphero is known for devices like the Sphero Bolt and BB-8 Star Wars toy, but now the company is back with another addition to its lineup -- the Sphero RVR. The RVR is a fully programmable robot car that can be expanding with different…

Luminar’s libraries gain speed, drop need for you to manually import images

Luminar 3 just got a performance boost. Skylum Luminar 3.0.2 has improved speed over December's update, which added the long-promised libraries feature giving editors a Lightroom alternative.

Keep your portable computer safe and shiny with the best laptop bags for 2019

Choosing the right laptop bag is no easy feat -- after all, no one likes to second-guess themselves. Here are some of the best laptop bags on the market, from backpacks to sleeves, so you can get it right the first time around.

Like to be brand loyal? These tech titans make some of our favorite laptops

If you want to buy your next laptop based around a specific brand, it helps to know which the best brands of laptops are. This list will give you a good grounding in the most reliable, quality laptop manufacturers today.

Protecting your PDF with a password isn't difficult. Just follow these steps

If you need to learn how to password protect a PDF, you have come to the right place. This guide will walk you through the process of protecting your documents step-by-step, whether you're running a MacOS or Windows machine.

Microsoft extension adds Google Chrome support for Windows Timeline

The Windows Timeline feature is now much more versatile thanks to the added support for Google's Chrome browser. All you need to do to increase its functionality is to download the official Chrome extension.

Google Earth spills the beans, reveals Taiwan’s secret military bases

Google Earth 3D Maps has spilled the beans on Taiwan's deepest secrets. The locations available in full three-dimensional detail include a facility which houses Patriot missiles and the country's National Security Bureau.