Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

US Taxpayers Targeted With RAT Malware In Ongoing Phishing Attacks

US Taxpayers Targeted With RAT Malware In Ongoing Phishing Attacks

US taxpayers are being targeted by phishing attacks attempting to take over their computers using malware and steal sensitive personal and financial information.

According to the Treasury Department, the IRS received over 141 million individual income tax returns [PDF] during the 2019 filing season, with roughly 90.4 percent of them (around 127 million) having been filed electronically.

“Social engineering via phishing emails continues to be the preferred infection method among both cybercriminals and nation-state threat actors,” said Assaf Dahan, senior director and head of threat research at Cybereason.

“The potential for damage is serious and the malware allows threat actors to gain full control over a victim’s machine and steal sensitive information from users or their employers.”

This ongoing phishing campaign will have more time to infect taxpayers with malware since the Treasury Department and the Internal Revenue Service (IRS) announced Wednesday that the federal income tax filing due date for individuals would be extended by an additional 30 days to May 17 2021.

Also Read: 3 Reasons Why You Must Take A PDPA Singapore Course

Evades detection via steganography, DLL sideloading, and legitimate platform abuse

The attackers send emails with malicious document attachments camouflaged as tax-related docs asking the potential victims to enable editing as detailed in a report published by the Cybereason Nocturnus Team today.

This instead will enable embedded macros to download a malware loader that uses DLL sideloading to deploy and launch a NetWire or Remcos payload hidden inside an image file hosted on the imgur cloud image storage service.

The malicious documents also evade traditional anti-malware virus and heuristic detections by abusing the imgur service to host the malware payloads, making it even harder to detect and block their attacks.

“The use of various techniques such as steganography, storing payloads on legitimate cloud-based services, and exploiting DLL sideloading against a legitimate software makes these campaigns very difficult to detect,” Dahan added.

“The sensitive information collected from the victims can be sold in the underground communities and used to carry out all manner of identity theft and financial fraud.”

Attack flow (CyberReason)

RAT malware used to takeover taxpayers’ devices

NetWire and Remcos are two well-known commercial remote access trojans (RATs) distributed under a subscription-based Malware-as-a-Service (MaaS) model.

Both RAT strains have been spotted in attacks coordinated by state-sponsored hacking groups and financially motivated threat actors.

They provide attackers with keylogging and password-stealing features, and remote control capabilities that allow them to take control of the compromised devices.

Scammers have been spotted impersonating the IRS in e-mails attempting to trick targets into paying fabricated outstanding amounts related to missed or late payments and threatening them with legal charges.

Sensitive information harvested during such phishing campaigns could later be used for identity theft and tax-related fraud.

Also Read: What You Should Know About The Data Protection Obligation Singapore

The US Federal Trade Commission (FTC) warned last month that the number of identity theft reports has doubled during 2020 compared to 2019, reaching a record of 1.4 million reports within a single year.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us