Cybercriminals targeted at least 400 industrial companies

In Analyst Corner

Kaspersky Lab researchers have detected a new wave of financial spear-phishing emails designed to make money for cybercriminals. The emails are disguised as legitimate procurement and accounting letters and have hit at least 400 industrial organizations, mostly in Russia. The series of attacks started back in autumn 2017 and targeted several hundreds of company PCs in industries ranging from oil and gas, to metallurgy, energy, construction, and logistics.

In the detected wave the criminals not only attacked industrial companies together with other organizations, they were predominantly focused on them. They sent out emails containing malicious attachments and try to lure unsuspecting victims into giving away confidential data, which they could then use to make money.

According to Kaspersky Lab data, this wave of emails targeted around 800 employee PCs, with the goal of stealing money and confidential data from the organizations, which can then be used in new attacks. The emails were disguised as legitimate procurement and accounting letters, containing content that corresponded to the profile of the attacked organizations and took into account the identity of the employee – the recipient of the letter. It is noteworthy that the attackers even addressed the targeted victims by name. This suggests that the attacks were carefully prepared and that criminals took the time to develop an individual letter for each user.

When the recipient clicked on the malicious attachments, modified legitimate software was discreetly installed on the computer so that criminals could connect to it, examine documents and software related to the procurement, financial and accounting operations. Furthermore, the attackers were looking for different ways to commit financial fraud, such as changing requisites in payment bills in order to withdraw money for their benefit.

Moreover, whenever criminals needed additional data or capabilities, such as obtaining local administrator rights or stealing user authentication data and Windows accounts to spread within the enterprise network, the attackers uploaded additional sets of malware, prepared individually for an attack on each victim. This included spyware, additional remote administration tools that extend the control of attackers on infected systems and malware to exploit vulnerabilities in the operating system, as well as the Mimikatz tool that allows users to obtain data from Windows accounts.

“The attackers demonstrated a clear interest in targeting industrial companies in Russia. Based on our experiences, this is likely to be due to the fact that their level of cybersecurity awareness is not as high as it is in other markets such as financial services. That makes industrial companies a lucrative target for cybercriminals – not only in Russia, but across the world,” said Vyacheslav Kopeytsev, security expert at Kaspersky Lab.

Kaspersky Lab researchers advise users to follow these key measures in order to be protected against spear-phishing attacks:
– use security solutions with dedicated functionality aimed at detecting and blocking phishing attempts. Businesses can protect their on-premise email systems with targeted applications inside the Kaspersky Endpoint Security for Business suite. Kaspersky Security for Microsoft Office 365 helps to protect the cloud-based mail service Exchange Online inside the Microsoft Office 365 suite.
–  introduce security awareness initiatives, including gamified training with skills assessments and reinforcement through the repetition of simulated phishing attacks. Kaspersky Lab customers would benefit from using the Kaspersky Security Awareness Training services.

Comments

You may also read!

4.5 billion data records being compromised

Gemalto, today released the latest findings of the Breach Level Index, a global database of public data breaches, revealing 945

Read More...

GreyEnergy group targeting critical infrastructure

ESET has uncovered details of a successor to the BlackEnergy APT group. Named GreyEnergy by ESET, this threat actor

Read More...

STC and F5 Network to offer Web Application Firewall services

STC Solutions has signed a MoU with F5 Networks during the ongoing GITEX Technology Week to offer Web Application

Read More...

Join Our Newsletter!

Love SecurityMEA? We love to tell you about our new stuff. Subscribe to newsletter!

Mobile Sliding Menu