Don't click on links or open attachments in email.To help you avoid tax-related email scams this time of year, Cybereason offers the following tips: 'The sensitive information collected from the victims can be sold in the underground communities and used to carry out all manner of identity theft and financial fraud,' Dahan added. 'The use of various techniques such as steganography, storing payloads on legitimate cloud-based services and exploiting DLL sideloading against a legitimate software makes these campaigns very difficult to detect,' Assaf Dahan, senior director and head of threat research at Cybereason, said in a press release. Through steganography, the payloads are hidden and downloaded within seemingly innocent image files. The attackers use a legitimate cloud service and a legitimate VPN app to install the Trojans. This particular tax-related scam tries to avoid standard security detection through a few different tricks. SEE: Social engineering: A cheat sheet for business professionals (free PDF) (TechRepublic) NetWire has been active in various forms since 2012, while Remcos popped up in 2016. Remcos can also steal your browser history and credentials, access your file manager and get information about your system. Once installed, NetWire is able to capture your screen, manage data copied to the clipboard and download additional payloads. In some cases, customers who opt for a subscription actually receive 24/7 support and software updates. Using a Malware-as-a-Service model, both are available through different licensing plans. The process uses a technique called steganography in which the malicious code is hidden within a plain-looking JPG image file, according to Cybereason.īoth NetWire and Remcos are commercial RATs up for sale for as little as $10 per month. This then creates a connection to a legitimate cloud service called 'imgur' from which the NetWire or Remcos malicious payload is installed.

If the document is opened and the necessary permissions are granted by the recipient, the macro executes and downloads an OpenVPN client on the machine. The Word document attached to the phishing email contains a malicious macro. But this document actually triggers a chain of events to install the NetWire and Remcos remote access trojans (RATs), which the attackers can use to control the infected systems. The phishing emails claim to contain a tax-related document that might interest people this time of year. End user data backup policy (TechRepublic Premium)Ĭybereason's Nocturnus threat analysis team has discovered a new phishing campaign aimed at US taxpayers.8 advanced threats Kaspersky predicts for 2022.Log4j: How to protect yourself from this security vulnerability.Just in time for Christmas, Kronos payroll and HR cloud software goes offline due to ransomware.

Ultraviewer faqs