Cyber Attack Alert
A new attack observed using COVID-19/Coronavirus-themed email appears to be coming from the WHO delivers the infamous Lokibot malware.
The emails contain a compressed file and the compression used is ARJ, which is used for creating more high-efficiency compressed file archives.
Alert COVID-19 Themed Attack
The compressed file is with the extension “Doc.zip.arj“, when decompressing in 7-zip the payload file “DOC.pdf.exe“, a method to trick the users hoping it is not an executable one.
Themed attackThe campaign was observed by Fortinet, once the executable (“COVID_19- WORLD HEALTH ORGANIZATION CDC_DOC.pdf.exe”) is opened the victim machine gets infected with the Lokibot malware.
Lokibot malware was first time discover in the year 2015, it is designed to steal information and data from the infected system.
It collects information and credentials from multiple web applications, such as Google Chrome, Mozilla Firefox, Thunderbird, FTP applications.
There is news that The malware was also sold in underground hacking markets, it was initially advertised as an information stealer and keylogger, later it continues to enhance its capabilities.
Recently it was distributed using a powerful code injection technique to evade the detection, anti-analysis technique and disable the security tools that run in the target victims’ computer.
According to Fortiguard telemetry, the campaign found to be active since the end of March and it attacks the following countries.
“The Top 10 sites targeted by this campaign: Turkey (29%), Portugal (19%), Germany (12%), Austria (10%), and the United States (10%) top the list, with Belgium, Puerto Rico, Italy, Canada, and Spain rounding out the top 10 with less than one per cent each.”
In a recent attack campaign, Lokibot trojan malware used as a popular game launcher to trick users into executing malware on their machines.
Due to Coronavirus and lockdown internet usage increase 200% and this increased Cyberattack. and need awareness about cybersecurity and self-protection so that you can self your money and data.
I am a Cyber Security expert cover cybercrime, privacy, security and surveillance, consumer technology, and anything else that seems interesting.
