Don’t Fall For Office 365 Zoom Notification Phishing Email

Do you use Microsoft Office 365? Do you also use Zoom? If so, be advised that there's a new phishing campaign designed with you specifically in mind, the goal of which is to ultimately make off with your Office 365 login credentials. Since the start of the global pandemic, Zoom and other video conferencing solutions have seen an explosion in the size of their user base, given that COVID-19 forced tens of millions to work from home.

In a nutshell, here's now the new campaign works:

The hackers controlling the campaign kick things off by sending out what appear to be automated Zoom account suspension alerts. These are convincingly crafted and make it appear that your account has been compromised. The message is invariably either a carbon copy or a slight variant of the following:

"We've temporarily suspended your Zoom because your email failed to sync with our server within the past 24 hours. At this time, you will not be able to invite or join any call/meeting. Please verify your email:"

And then, just below the 'Please verify your email' bit in the body of the message, the hackers have included a button labeled 'Activate Account,' which a fair percentage of this message's recipients are clicking on.

Clicking on the button opens a browser tab and takes the email recipient to a well-designed spoof of a Microsoft Login page which asks for the user's credentials.
Naturally, if the user enters their login information here, nothing will happen except that the information will be stored in a database belonging to the cybercriminals, who will no doubt use it later.

Not long ago, the US FBI issued a warning about BEC scammers targeting users of popular cloud-based email services like Google's G-Suite and Microsoft's Office 365 to steal credentials for use in attacks down the road. This latest campaign certainly seems to add an exclamation point to the end of that warning. Stay on your guard and make sure your employees are aware.

Call SpartanTec, Inc. now and let our team of IT specialists set up the appropriate cybersecurity measures that will help keep scammers and phishing Columbia SC at bay.

SpartanTec, Inc.
Columbia, SC 29201
(803) 408-7166
http://manageditservicescolumbia.com/

cities served:
Columbia, West Columbia, Cayce, St Andrews, Lexington, Oak Grove

Coronavirus Health Notifications Being Used To Carry Malicious Threats

A Pakistani-based hacking group that goes by a variety of names, including "Transparent Tribe," "APT36," "Mythic Leopard" and others has been discovered to be behind a particularly nasty attack recently.

Researchers with QiAnXin's RedDrip Team discovered a phishing campaign bearing the group's stamp.

This new campaign utilizes poisoned files that appear to be health advisories sent by the Indian government. These days, people are desperate for information about the Coronavirus, and the hacking group is taking full advantage.

Their poisoned documents are being opened at an alarming rate, and when they are, a malicious tool called the Crimson RAT (Remote Administration Tool) is being installed.
This tool allows the hacker group to, (among other things):

• Capture screenshots
• Collect information about the antivirus software the victim's computer or device uses
• Make use of TCP protocols for communicating with the command and control server
• Stealing credentials from the victim's browser
• Listing running process, drives and directories on the victim's machine
• Retrie files from its C&C server

While all of those are bad, the last one is probably the most dangerous. Once the hackers have established an entry point on the infected system, they can use the communications link with the C&C server to install literally any other type of software they want.

For the time being, the group has contented themselves with operations in India, but they're not the only state sponsored threat actor on the world stage. They're certainly not the only ones to be using the fear surrounding the Coronavirus as cover for their nefarious activities.

Be sure your employees are aware of this new threat, and adopt the policy of not opening any health related information you get via email. If you want to know the latest information available, instruct your team to go to the CDC's website and pull it straight from the source.

Keep your employees and your business safe against opportunist and hackers amid the coronavirus pandemic. Call SpartanTec, Inc. and let our team set in place the appropriate online security measures for you and your remote workers.

SpartanTec, Inc. Columbia, SC 29201 (803) 408-7166 http://manageditservicescolumbia.com/

cities served:
Columbia, West Columbia, Cayce, St Andrews, Lexington, Oak Grove