Cyber-threat Alert: Summer 2017 Phishing Trip to Avoid

A Special Update from the Comodo Threat Intelligence Lab

Phishing attacks using emails have become very common but the techniques are continually being enhanced and personalized to the point where we all need a refresher course. In the past, very obvious grammatical and spelling errors made many phishing attempts easier to spot, but each month seems to now bring more sophisticated versions. In July 2017, The Comodo Threat Intelligence Lab has identified a new series of phishing emails that purport to be replies to previously asked requests for information from well-known brands and likely legitimate contacts. If you’ve tracked a package or status of an order for anything in recent times, you’ll recognize the format. These emails contain links to illegitimate sites and malware payloads, and cleverly attempt to get the user to click on them.

An example can be seen in the screenshot below.

As you can see the email contains what looks like an original request for information below their fraudulent “response,” which includes the illicit link. The link itself at first glance looks legitimate, having been crafted to look similar to a real URL to even savvy users, but actually drives to an entirely different site and a delivers its remotely deployed malware payload.

Fatih Orhan, head of the Comodo Threat Intelligence Lab and Comodo Threat Research Labs (CTRL), said, “Phishing emails come in numerous types and formats. Cyber criminals always find new methods to trick users and convince them to click a “bait” link. This latest method is also an example of how they can be creative to attack enterprise business users. At the lab we have identified hundreds of different servers being used for this phishing campaign as it attacked more than three thousand of enterprise customer users. Orhan went on to state, “The phishing emails are all being sent in a short time, as the campaign started at 2017-07-06 10:28:44 and finished at 2017-07-06 17:12:31.  In less than 7 hours, a total of 585 different servers are being used to target more than 50 enterprise customers, affecting thousands of users.“

The 585 IP addresses, by Country, shows that most of the servers to be in North America, Europe, Australia and Turkey as:

Most definitely an advance in phishing attack sophistication, this illustrates the speed in which coordinated, multi-server attacks on businesses are being developed and deployed. With enterprise customers in this case, only the ones with a “default deny” security posture were completely safe and the Comodo Threat Intelligence Lab actually first discovered the malware as new, unknown files via Comodo customers using the “default deny” security posture combined with auto-containment and threat intelligence lab analysis (included in their Comodo Advanced Endpoint Protection solutions).

The Comodo Threat Intelligence Lab update video for the week of July 12, 2017 will provide more details on this new threat, so be sure check out that video and special updates from the lab for more information.

About the Comodo Threat Intelligence Lab:

The Comodo Threat Intelligence Lab (the Lab) monitors, filters and contains, and analyzes malware, ransomware, viruses and other “unknown” potentially dangerous files 24x7x365 in over 190 countries around the world. With 5 offices spread across the Americas, Asia, and Europe (and staff covering over 190 countries), the Lab is made up of more than 120 IT security professionals, ethical hackers, computer scientists and engineers (all full-time Comodo Lab employees) analyzing millions of potential pieces of malware, phishing, spam or other malicious/unwanted files and emails every day. The Lab also works with trusted partners in academia, government and industry to gain additional insights into known and potential threats.

The Lab is a key part of the Comodo Threat Research Labs (CTRL), whose mission is to use the best combination of cybersecurity technology and innovations, machine learning-powered analytics, artificial intelligence, and human experts and insights to secure and protect Comodo customers, business and public sector partners, and the public community.

Related Resource:

• Hack Email