Cybersecurity company CrowdStrike has described phishing attacks that claim to come from security companies, including CrowdStrike itself.
Brazen cybercriminals are now impersonating cybersecurity firms in phishing messages that claim the recipient has suffered a cyberattack and must act urgently to protect their network.
But if the recipient responds, they risk opening the door to hackers and seeing their systems compromised by malware, ransomware and other dangerous cyber threats.
The phishing campaign was described by researchers at CrowdStrike, one of several cybersecurity companies being impersonated by cybercriminals to trick victims into calling a fake helpline, which then persuades the victim to grant remote access to their network. CrowdStrike has not disclosed details of the other cybersecurity companies being impersonated.
The message claims to have been sent by “your company’s outsourced data security services provider” and says that “anomalous activity” and a “potential breach” were detected on the network during a “daily network audit”.
It goes on to claim that the cybersecurity provider is already working with the company’s information security team, but has also been told to contact employees about their own computers, and that it is “imperative” that the person receiving the email responds.
The recipient is given an incident case number and asked to call a specific phone number to arrange an audit. The example described by CrowdStrike also carries accurate branding.
CrowdStrike calls this “callback phishing”, because when the victim calls the number they are connected to an operator who tries to persuade them to install remote administration tools (RATs) to gain access to the network.
Although the victim may believe the RAT — a tool many IT teams use for legitimate purposes — is being installed to deal with an infection, in reality they are unwittingly giving the cybercriminal initial access to the network for later use.
“This is the first identified callback campaign impersonating cybersecurity entities, and it has a higher potential for success given the urgent nature of cyberattacks,” CrowdStrike said in a blog post.
The researchers could not determine exactly what the criminals behind this particular social engineering and phishing campaign are doing, but they note that a similar campaign identified in March this year installed remote access software to enable lateral movement across networks and deploy malware.
The likely end goal of the cybercriminals behind these phishing attacks is to monetise the access victims have been tricked into giving them, possibly through ransomware attacks. These attacks may be carried out by cybercriminals who encrypt the network with ransomware themselves, or they may sell access to the compromised network to ransomware groups.
“CrowdStrike will never contact customers in this way,” the company said, and anyone who receives such an email is strongly advised to forward it to their cybersecurity provider for investigation.
Based on the article “Brazen crooks are now posing as cybersecurity companies to trick you into installing malware”
Read at the source (in Russian): Hackers are now posing as cybersecurity companies ⋆ DW