WeTransfer Used in Novel Phishing Attacks and Other News

New Wave of Phishing Attacks Uses WeTransfer for URL Obfuscation

A new phishing technique has surfaced, using the file hosting service WeTransfer. By hosting malicious HTM and HTML files on the site, attackers are able to leverage the site to redirect victims to a phishng website. Victims are then prompted to enter account credentials. This technique may bypass some protection platforms given that a legitimate service is being misused.

Recommendations

• Enable multi-factor authentication for all accounts to prevent potential account takeover.
• Always verify the sender of suspicious emails.
• Never download attachments from unknown senders or suspicious email.
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for those entities. Reach out to [email protected] for assistance, if needed.

Details

WeTransfer, a popular file hosting site, has recently been used to redirect users to malicious phishing sites. Researchers have identified a new phishing technique where attackers will host malicious HTM or HTML files on WeTransfer. The site is used to send potential victims a legitimate email, stating that files have been shared with them.

Figure 1. Example lure email contaning link to malicious files on WeTransfer.

When a user clicks the link in the email, they are taken to an HTM or HTML files hosted on WeTransfer. If they download and open this file, they are redirected to a phishing link. At this point, victims are generally asked to enter Microsoft Office credentials. This is a useful technique for attackers looking to bypass detection, and some email security platforms may not detect these attacks, because WeTransfer is a legitimate file hosting service.

Breaking News - 07.24.2019

Vigo County, Indiana Hit With Ransomware in Yet Another Attack Against Small Governments

Vigo County, Indiana, has been compromised in a ransomware attack. This is yet another attack in a recent wave of attacks against small city governments, with other notable victims including Baltimore, two municipalities in Florida, and other counties in Indiana.

See the full report here: https://www.heraldbulletin.com/indiana/news/malware-attack-hits-vigo-county-computers/article_ac8975c7-89c9-5872-94c0-2cb49918fa20.html

Vulnerability Indentified in ProFTPD Server

A vulnerability in ProFTPD has been discovered, that could allow for the unauthorized transfer of files on a vulnerable server.

See the full report here: https://www.bleepingcomputer.com/news/security/proftpd-vulnerability-lets-users-copy-files-without-permission

Former Siemens Contractor Pleads Guilty in Code Injection Case

A 62-year old former contractor for Siemens has pled guilty to the injection of "logic bombs" into programs used by the company. "Logic bombs" are code intentionally designed to crash or malfunction if certain criteria is met. David Tinley, the former employee, is facing up to 10 years in jail along with fines of up to $250,000.

See the full report here: https://thehackernews.com/2019/07/siemens-logic-bomb.html