New QR Code Scam Steals Banking Credentials

Scan This Code - Drain Your Bank Account

A new financial scam has been reported, involving the use of QR codes by scammers. After convincing victims to scan a malicious code, scammers harvest banking credentials in order to drain bank accounts. This has been used successfully in multiple European cities - and Dutch police arrested two scammers in the last week who utilized this technique.

Recommendations

• Consider enabling the Cyber Attack Chatter rule to monitor discussion of the use of this method on criminal forums.
• Never scan QR codes from unknown persons or sources. In addition to the scam discussed in this adviisory, criminals have been known to utilize them to drop malware onto mobile devices.

Details

A new QR code scam has been reported, involving the use of QR code in payments to strangers. This may seem far-fetched, however, scammers generally approach this in a manner that seems rational. Generally, a scammer will approach a potential victim, and offer them cash in exchange for their help in paying for parking. With the recent upsurge in parking payment platform applications, this does make some amount of sense. These parking apps do not take cash - and so, the attacker will offer cash to the victim in exchange for the victim scannning the QR code with their banking app. This QR code, however, gives the scammer the victim's banking credentials. This scam technique has surged in popularity throughout Europe in recent months. Dutch police have arrested two suspects, after they successfully utilized this technique to rob people of tens of thousands of Euros.

Breaking News - 08.02.2019

Apple Suspends Siri Program After Privacy Backlash

In-home voice technology from Apple, Siri, faced public backlash after their program for how they retain private, in-home data. The Guardian ran a report here about how contractors for Apple would listen to intimate recordings that Siri logged, all in the sake of improving audio accuracy, via a process called "grading". Apple quickly remediated the backlash by suspending the program and making it optional for Apple Siri users to send their data to the tech giant.

See the full report here: https://threatpost.com/apple-suspends-siri-program-privacy-backlash/146894/

Cobalt Group Returns To Kazakhstan

The Cobalt Group has recently been targeting a bank in Kazakhstan, using malicious office documents spoofing the targeted bank itiself to gain access to internal networks. This is yet another example of attackers abusing brand resources - in this case, official bank logos - in order to bolster the legitimacy of their attacks.

See the full report here: https://research.checkpoint.com/cobalt-group-returns-to-kazakhstan/

New Ransomware: Clop

New research on the Clop ransomware family has been released. Interestingly, many of the system checks are conducted in Georgian, Russiann, and Azerbaijan, suggesting the author had knowledge of those languages. Also of note: the majority of detections of this malware family come from Canada.

See the full report here: https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/clop-ransomware/

Brand-New SystemBC Proxy Malware Spotted Using SOCKS5 for Stealth

A new malware family, SystemBC, has been utilizing SOCKS5 in order to evade detection as it is distributed by the RIG and Fallout exploit kits. Post infection, the malware sets up SOCKS5 proxy tunnels in order to hide traffic, and evade detectipnn. This malware has largely been spotted in Asia.

See the full report here: https://threatpost.com/systembc-proxy-malware-socks5-stealth/146879/

90% of Enterprise iPhone Users Open to iMessage Spy Attack

Several vulnerabilities have been identified by the research team at Google's Project Zero in Apple iOS - including one that allows for remote exploitation of iMessage with no user interaction required. Although the majority of these vulnerabilities have now been patched by Apple, only a very small percentage of vulnerable devices have been updated. To protect against potential leak of pictures, videos, annd other files stored on iOS devices, Alpha Team recommends updating to iOS 12.4 as soon as possible.

See the full report here: https://threatpost.com/90-enterprise-iphone-users-imessage-spy-attack/146899/

Threat Actors Utilizing eCh0raix Ransomware Change NAS Targeting

Recent waves of ransomware attacks have been identified targeting NAS (Network Attached Stoage) devices. eChr0raix has been spotted enncrypting files on these devices, with attackers demanding payment in order to unlock these files. Unlike many other ransomware families, this ransomware actually uses a chat functionality to connect victims with their attacker for support related to providing payment in hopes that files are unencrypted.

See the full report here: https://www.anomali.com/blog/threat-actors-utilizing-ech0raix-ransomware-change-nas-targeting#When:18:33:00Z

After Hacking 250M Accounts, TrickBot Trojan Can Now ‘Disable’ Windows Defender

TrickBot rears its ugly head again with additional capabilities. It is typically used as a banking trojan, but the modular capability of the trojan allows it to adapt to defenses easily. This article outlines how new variants of TrickBot are now disabling Windows Defender.

See the full report here: https://fossbytes.com/new-trickbot-trojan-can-disable-windows-defender-to-steal-your-data/