On June 20, 2024, Rapid7 identified multiple intrusion attempts by threat actors utilizing techniques, tactics, and procedures (TTPs) that are consistent with an ongoing social engineering campaign being tracked by Rapid7.
The initial lure being utilized by the threat actors remains the same: an email bomb followed by an attempt to call impacted users and offer a fake solution. In the recent cases handled by Rapid7, external calls were typically made to the impacted users via Microsoft Teams. Once on the phone, the threat actor would convince the user to download and install AnyDesk, a popular remote access tool that allows the threat actor to take control of the user’s computer.
Read more…
Source: Rapid7
Related:
- Estonia: Cyber attack brought Elron ticketing system down Wednesday
September 21, 2023
Ticket sales for national rail carrier Elron’s trains were disrupted Wednesday afternoon, after a cyber attack. Elron spokesperson Kristo Mäe said at the time that: “Until the situation is resolved and it remains, for technical reasons, impossible to purchase a ticket while on the train, passengers can travel for free,” adding that passengers with cash on ...
- DoppelPaymer ransomware group suspects identified
September 20, 2023
The German police in cooperation with the US Secret Service have executed search warrants against suspected members of the DoppelPaymer ransomware group in Germany and Ukraine. In March of 2023 the German Regional Police and the Ukrainian National Police, with support from Europol, the Dutch Police, and the United States Federal Bureau of Investigations (FBI), apprehended ...
- China’s Ministry of State Security reveals US’ infiltration of Huawei traced back to 2009
September 20, 2023
The US’ infiltration of Huawei headquarters’ servers can be traced back to 2009, China’s Ministry of State Security (MSS) said in an article released on Wednesday. The Chinese ministry disclosed despicable methods of cyber espionage adopted by US intelligence agencies, which include establishing cyberattack arsenals, coercing technology companies to cooperate, and distorting the truth to ...
- FBI and CISA Release Advisory on Snatch Ransomware
September 20, 2023
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint CSA to disseminate known ransomware IOCs and TTPs associated with the Snatch ransomware variant identified through FBI investigations as recently as June 1, 2023. Since mid-2021, Snatch threat actors have consistently evolved their tactics to take advantage of ...
- Australia: Pizza Hut says customer data breached in cyber hack
September 20, 2023
The personal details of pizza lovers across Australia have been compromised in a cyber attack on Pizza Hut. The popular fast-food chain, with 251 restaurants across the country, revealed it had been hacked in an email to customers on Wednesday. “In early September, we became aware of a cyber security incident where an unauthorised third party ...
- Cyber attack on International Criminal Court in The Hague; Hackers stole sensitive docs
September 20, 2023
The International Criminal Court (ICC) in The Hague fell victim to a cyber attack last week, the court confirmed in a statement after reporting by NOS. A source told the broadcaster that the hackers gained access to a large number of sensitive documents, but an ICC spokesperson would not confirm that. The spokesperson told NOS that ...