Wednesday , December 4 2024

Trickbot Attackers Leverage On Coronavirus Fears To Send Spam Mails – SophosLabs Announces

….as company numerates steps to remain safe from attackers

In the last 24 hours, SophosLabs has uncovered a new email spam attack targeting Italians with a document containing a macro loaded with Trickbot malware.

The email takes advantage of COVID-19 fears by offering up a clickable document that allegedly includes a list of precautions to take to prevent infection. Unfortunately, the document is weaponized.

According to SophosLabs, the COVID-19 twist to the spam message may be new, but the mechanisms used to deliver it (including the spam “bots” that send the message, the enclosed scripted Word document and the JavaScript dropper) are similar or identical to those used in Trickbot campaigns that have been active for at least six months.

“The cybercriminals behind Trickbot are likely skilled attackers who leverage the concern of the day to scare people into clicking. While this is in Italy now, we would expect a similar attack in other countries where fears of COVID-19 outbreaks are high. The best approach to avoid this type of cyberattack is to turn off macros, be extra cautious about what you click, and delete email that is suspicious or from an unexpected source,” said Chester Wisniewski, principal research scientist, Sophos. “Whenever there is a topic of public interest like COVID-19 or the Australian bush fires, we see cybercriminals try to manipulate our concern into an opportunity. We must stay vigilant and be distrustful of incoming communications during times of crisis and only obtain advice from our public health authorities.”

For additional tips, please reference Naked Security’s article on other Coronavirus phishing emails and how to stay cybersafe, including:

Never let yourself feel pressured into clicking a link in an email. Most importantly, don’t act on advice you didn’t ask for and weren’t expecting. If you are genuinely seeking advice about the coronavirus, do your own research and make your own choice about where to look

Don’t be taken in by the sender’s name. This scam says it’s from “World Health Organization”, but the sender can put any name they like in the From: field

Look out for spelling and grammatical errors. Not all crooks make mistakes, but many do. Take the extra time to review messages for telltale signs that they’re fraudulent – it’s bad enough to get scammed at all without realizing afterwards that you could have spotted the fraud up front

Check the URL before you type it in or click a link. If the website you’re being sent to doesn’t look right, stay clear. Do your own research and make your own choice about where to look

Never enter data that a website shouldn’t be asking for. There is no reason for a health awareness web page to ask for your email address, let alone your password. If in doubt, don’t give it out

If you realise you just revealed your password to imposters, change it as soon as you can. The crooks who run phishing sites typically try out stolen passwords immediately (this process can often be done automatically), so the sooner you react, the more likely you will beat them to it.

READ ALSO: Sophos introduces Xstream architecture for XG firewall

Never use the same password on more than one site. Once crooks have a password, they will usually try it on every website where you might have an account, to see if they can get lucky.

Turn on two-factor authentication (2FA) if you can. Those six-digit codes that you receive on your phone or generate via an app are a minor inconvenience to you, but are usually a huge barrier for the crooks, because just knowing your password alone is not enough.

Educate your users. Products like Sophos Phish Threat can demonstrate the sort of tricks that phishers use, but in safety so that if anyone does fall for it, no real harm is done. Sophos also has a free anti-phishing toolkit which includes posters, examples of phishing emails, top tips to spot a phish, and more

 

 

 

Trickbot

About Bukola Olanrewaju

Check Also

Stars, Smiles, and Surprises: Highlights from the TECNO SPARK 30 City Tour 

Ikeja came alive on Friday, November 15, as the TECNO SPARK 30 city Tour brought …

Leave a Reply

Your email address will not be published. Required fields are marked *