{"id":9014,"date":"2020-06-11T21:40:23","date_gmt":"2020-06-11T18:40:23","guid":{"rendered":"https:\/\/forklog.media\/?p=9014"},"modified":"2020-06-11T22:57:34","modified_gmt":"2020-06-11T19:57:34","slug":"cybercriminals-exploit-black-lives-matter-campaign-to-distribute-malware-via-email-amid-social-unrest","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/cybercriminals-exploit-black-lives-matter-campaign-to-distribute-malware-via-email-amid-social-unrest\/","title":{"rendered":"Cybercriminals Exploit Black Lives Matter Campaign to Distribute Malware via Email Amid Social Unrest"},"content":{"rendered":"<p>Threat actors are now exploiting the Black Lives Matter campaign to distribute malware via email, which lures users to open an attached Microsoft Word file to \u201cleave a review confidentially about Black Lives Matter.\u201d The phishing emails\u2019 subject line goes as \u201cVote anonymous about \u2018Black Lives Matter.\u2019\u201d<\/p>\n<p><!--more--><\/p>\n<p>Once a user opens the attached file, it initiates the installation of the so-called TrickBot trojan. Initially, TrickBot began in 2016 as a banking trojan targeting Windows operating system to harvest emails, credentials, and steal banking information. However, the malware has evolved to perform other malicious tasks such as stealing cookies, OpenSSH keys, and Active Directory Services databases, among other things.<\/p>\n<p>A spokesperson for cybersecurity non-profit Abuse.ch, who <a href=\"https:\/\/bazaar.abuse.ch\/sample\/af3fcc4d0646a3a2c27512b07a0c84428ced10606e28e248ecfcd8c2569d85d8\/\">discovered<\/a> the attack on June 10, <a href=\"https:\/\/www.forbes.com\/sites\/thomasbrewster\/2020\/06\/11\/watch-out-theres-a-big-black-lives-matter-scam-about\/#7c7cb61162d8\">told<\/a> Forbes:<\/p>\n<blockquote><p><strong><i>\u201cFrom what I see is that the spam campaign was pretty big, apparently hitting U.S. mailboxes. Historically, TrickBot is an e-banking trojan. However, these days TrickBot is heavily used by various threat actors to install additional malware on the victim&#8217;s computer. In corporate networks, this usually leads to Ransomware such as Ryuk.\u201d<\/i><\/strong><\/p><\/blockquote>\n<h2>Cyber Attacks Rise Amid Social Unrest<\/h2>\n<p>Cyber attacks rise amid social unrest around the globe connected to public health crises, natural disasters, and terror attacks, among others. Thus, global uncertainty caused by the COVID-19 epidemic has resulted in a surging number of malicious campaigns circulating the Internet, according to a recent <a href=\"https:\/\/www.pwc.com\/us\/en\/library\/covid-19\/cyber-attacks.html\">report<\/a> from PwC. They began in late January, wherein threat actors posed as a trusted organization like a bank or a merchant, and rocketed by the middle of March.<\/p>\n<p>The most popular criminal schemes include business email compromise scams, with cybercriminals attempting to obtain sensitive information or funds, as well as credentials, to further compromise companies\u2019 information systems. Often, bad actors disguise phishing emails as government announcements. The report explains:<\/p>\n<blockquote><p><strong><i>\u201cEmails include links to items of interest, such as \u2018updated cases of the coronavirus near you.\u2019 Landing pages for these false links may look legitimate, but the sites are often malicious and may be designed to steal email credentials.\u201d<\/i><\/strong><\/p><\/blockquote>\n<p>This spring, cybersecurity firm Kaspersky Lab alone <a href=\"https:\/\/www.wsj.com\/articles\/hackers-target-companies-with-fake-coronavirus-warnings-11583267812?tesla=y\">identified<\/a> 403 users of its security products, who were attacked with around 500 coronavirus-related files.<\/p>\n<p>In late May, Minneapolis <a href=\"https:\/\/forklog.com\/en\/following-police-brutality-and-riots-hackers-of-anonymous-attack-minneapolis-police\/\">police were hit with a DDoS attack<\/a> amid protests over the police killing of George Floyd earlier that week. The hackers attacked the PD\u2019s website and promised to expose a history of crimes committed by the officers.<\/p>\n<p><b>Follow us on\u00a0<\/b><a href=\"https:\/\/twitter.com\/forklogmedia\"><b>Twitter<\/b><\/a><b>\u00a0and\u00a0<\/b><a href=\"https:\/\/www.facebook.com\/forklogmedia\"><b>Facebook<\/b><\/a><b>\u00a0and join our\u00a0<\/b><a href=\"https:\/\/t.me\/forklogmedia\"><b>Telegram channel<\/b><\/a><b>\u00a0to know what\u2019s up with crypto and why it\u2019s important.<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Threat actors are now exploiting the Black Lives Matter campaign to distribute malware via email, which lures users to open an attached Microsoft Word file to \u201cleave a review confidentially about Black Lives Matter.\u201d The phishing emails\u2019 subject line goes as \u201cVote anonymous about \u2018Black Lives Matter.\u2019\u201d<\/p>\n","protected":false},"author":6,"featured_media":9016,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"","cryptorium_level":"","_short_excerpt_text":"","creation_source":"human_written","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[44,1111,100],"class_list":["post-9014","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybercrime","tag-cybersecurity","tag-malware"],"aioseo_notices":[],"amp_enabled":true,"views":"731","promo_type":"1","layout_type":"","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/9014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=9014"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/9014\/revisions"}],"predecessor-version":[{"id":9017,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/9014\/revisions\/9017"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/9016"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=9014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=9014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=9014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}