Email Security

Threat Spotlight: Ongoing “Sextortion” Scam Utilizes Breach Data

October 31, 2018 by Jonathan Tanner

Cybercriminals are nothing if not creative and opportunistic. Major world events have been used as a premise for spam and phishing attempts countless times in the past. International money scams use premises from multi-million-dollar inheritances to stranded travelers to defraud more gullible and less security-conscious internet users. Mix in some personal information and (fake) blackmail, and you have one of the most recent major phishing campaigns and the subject of this month's Threat Spotlight.

Highlighted Threat:

Sextortion Scam – Attackers use passwords stolen in past data breaches to trick users into paying Bitcoin to avoid having a compromising video, which attacker claim to have recorded on the victim’s computer, shared with all their contacts.

In this Threat Spotlight, @Barracuda examines sextortion scams where attackers use passwords stolen in a past #databreach to trick users into paying to avoid having a compromising video released Click To Tweet

Jonathan Tanner

Jonathan is a graduate of San Jose State University and a Software Engineer at Barracuda Networks. Connect with him on LinkedIn here.

https://www.barracuda.com

The Big Business of Spam: Online Dating Requests Through Email – Not So Fast

October 22, 2015 by Barracuda Labs

Meeting people online has never been easier, unfortunately for some people, falling for that perfect connection may not be the only thing they are falling for these days. Online dating scams are quickly becoming a likely possibility due to the giant audience attracted to online dating sites. It’s no secret that scammers target large audiences, and according to an article published on Match.com, there are currently over 40 million people trying to meet that special someone online. So, how can users avoid falling victim to an online dating scam without dumping the scene all together?

One way is to remain aware that any email you receive regardless of the topic – could be a scam in disguise. For example, through Barracuda Central, the Barracuda Labs team recently flagged and dissected a series of factious emails from scammers attempting to impersonate a missed connection from a dating site. These scams are banking on the potential that the recipient has an online dating account in order to bait them into replying to an offsite message. This particular email scam suggests that the recipient email them directly so they can get to know each other, which is simply a tactic used in order to bypass spam filters. Here is one of the messages we came across:

As you can see, this particular message is written poorly which should always raise a red flag, and if the recipient takes action and replies, the scammer's sob story quickly follows in hopes to earn the trust of the victim. Eventually these communications will lead to a request for the victim to wire money, which will be withdrawn from their bank account immediately and into an offshore account – where a refund is far from likely. Not only will your wallet be empty, your heart may be broken along with it, and you’ll be well on your way to a number one hit on the county music charts.

Not your idea of a good time? Fortunately, it might actually be easier to avoid these types of scams than to fall for one if you know how to stay safe. Based on the messages we’ve seen come through, scams similar to this one seem to be targeting men over 18, but that doesn’t mean you’re off the hook if you don’t fit that demographic. To keep yourself out of harm’s way when it comes to online dating and related email scams, take the following precautions:

Don’t reply to emails from a “missed connection” or to someone claiming to want to get to know you better through email – they most likely aren’t your soul mate.
When participating in online dating, keep your initial communications with connections through the dating site. You signed up to meet people – let them help you do that.
If you’re suspicious of any email, regardless of topic – don’t open it, reply to it, or click on any links associated. Better safe than sorry.

Barracuda Labs has covered quite a few topics related to how scammers are profiting from spam related tactics, to read more in our Big Business of Spam series, check out the following links:

https://barracudalabs.com/2015/09/adulterers-beware-scammers-may-be-targeting-you/

https://barracudalabs.com/2015/07/the-big-business-of-spam-stay-clear-of-these-too-hot-to-miss-sale-opportunities-from-your-facebook-friends/

https://barracudalabs.com/2015/06/the-big-business-of-spam-what-caitlyn-jenner-uses-to-prevent-wrinkles-and-stop-the-aging-process/

Barracuda Labs

The Big Business of Spam: Stay clear of these “too-hot-to-miss” sale opportunities from your Facebook Friends

July 20, 2015 by Barracuda Labs

We’ve previously warned about deals that are too good to be true (https://barracudalabs.com/2015/05/the-big-business-of-spam-dr-ozs-brand-new-trick-to-shed-27-pounds-in-just-one-month/) – and with summer in full swing, the Barracuda Labs team has seen more and more false domains like (rb-to.com, raybanglassesofhot.com and summer-raybans.com) popping up in feeds and social media timelines. Our Labs team ran a background check on the domains and many of them appear to be registered in China, including the domain listed above.

While browsing your Facebook or Twitter timelines, you may have come across “sponsored ads” that seem too good to be true. Most can be spotted immediately and swiftly ignored; however, you may have been tagged in a post or received a message on your personal timeline posted by a friend, directing you to a killer sale. See figure 1 for an example.

Figure 1.

The example above shows an ad for Ray Ban, a popular sunglass retailer whose classic sunglasses range from $155 to $200, that looks as though it was shared by a regular user or even a friend on Facebook. The ad targets unsuspecting consumers looking to score the name brand sunglasses for up to 80% off.

Figure 2.

The idea here, like any scam, is to entice unknowing consumers to jump on the hot deals and “buy” the Ray Ban’s at such low prices. Once the links are clicked on, the consumer is redirected to what looks like a legitimate discount website that is offering deals with up to 80% savings on multiple styles, see Figure 2 and Figure 3 for examples.

Figure 3.

The phisher hopes that the deal is too good for the consumer to pass up and engages in purchasing the product. Here, the phisher is hoping the consumer will enter their personal data like first and last name, emails address, personal home address and credit card information, to then flip and sell to third parties.

It is always smart to use best practices when shopping online. Here are a few tips:

Do a bit of research and go directly to the name brand website to see what offers are on the official website
Look for plain websites as a warning, as they are quickly put together with minimal tabs and functionality
Look for poor grammar and misspellings; because these fake sites are so quickly put together, often times spell checking isn’t their highest priority

Barracuda Labs encourages – if you do get tagged in an ad like this or find it posted to your wall – immediately untag yourself and delete it from your wall so you can avoid letting your friends or family members fall victim to the scam as well.

For more resources on the Big Business of Spam, you can see previous posts here:

https://barracudalabs.com/2015/06/the-big-business-of-spam-what-caitlyn-jenner-uses-to-prevent-wrinkles-and-stop-the-aging-process/

https://barracudalabs.com/2015/05/the-big-business-of-spam-dr-ozs-brand-new-trick-to-shed-27-pounds-in-just-one-month/

https://barracudalabs.com/2015/05/the-big-business-of-spam-scammers-once-again-looking-to-capitalize-on-a-tragic-natural-disaster/

Barracuda Labs

New Cryptolocker spear phishing campaign looks to be ‘The Grinch that stole Christmas’ in Australia

December 18, 2014 by Christine Barry

Cryptolocker is one of the most notorious attacks we’ve seen in a while, one which definitely would ruin someone’s day, or in this case holiday spirit. As of December 16 6:53AM PST, Barracuda Real-Time Systems have intercepted and blocked a new version which has a 1 out of 54 detection rate according to VirusTotal.

The attack comes as an email disguised as the State Debt and Recovery office in Australia. It uses a common fear tactic describing that a camera has caught the recipient speeding and must now pay a fine in order to avoid suspension of driver’s license or vehicle registration.

Once the victim clicks on the “Invoice” or “View Camera Images” – he is then directed to a website and instructed to download a penalty or reminder notice.

The webpage utilizes a captcha which will actually require the right combination of letters or numbers to download the file, possibly another trick by the attackers to legitimize the site.

Once downloaded and opened, Cryptolocker encrypts the data on the host computer, rendering all files to be unusable or opened until payment is made.

While these newer versions of Cryptolocker do not appear tied to the original version which was said to have been disrupted, we should remain vigilant of copycat attacks that have and will certainly follow.

As always, any emails received should be treated with extreme caution. Users should always keep anti-virus up to date, and use best practices when opening suspicious emails from unknown senders.

Customers running the Barracuda Spam Firewall and Barracuda Email Security Service with up to date security definitions are protected from these attacks.

Christine Barry

Christine Barry is Senior Chief Blogger and Social Media Manager at Barracuda. In this role, she helps bring Barracuda stories to life and facilitate communication between the public and Barracuda internal teams. Prior to joining Barracuda, Christine was a field engineer and project manager for K12 and SMB clients for over 15 years. She holds several technology credentials, a Bachelor of Arts, and a Master of Business Administration. She is a graduate of the University of Michigan.

Connect with Christine on LinkedIn and follow her on Twitter here.

https://blog.barracuda.com

Hackers take advantage of Ebola-related fundraising

November 14, 2014 by Christine Barry

Companies like Facebook, Google and YouTube have been taking a proactive approach to help fight the Ebola virus that has taken countless lives in Africa. When visiting these sites, you may notice that these companies are asking users to donate to finding a cure for the Ebola virus. Hackers in turn are also recognizing the opportunity to capitalize on the new trending topic.

With the fear of the Ebola virus making its way to the States, it’s not surprising that many folks are raising awareness and are now trying to educate themselves on the virus.

Christine Barry

Connect with Christine on LinkedIn and follow her on Twitter here.

https://blog.barracuda.com

Daniel Peck to present phishing detection methods at AppSec USA

September 12, 2014 by Christine Barry

AppSec USA is coming up next week and our own Daniel Peck will be there to discuss a new approach to phishing detection. Daniel is a Principal Research Scientist who works primarily on studying social networks as an attack vector. He has created a large body of work in research, such as:

Comparing content and non-content based systems to identify malicious accounts on Twitter/Facebook
Exploiting programmable logic controllers
Identifying/classifying malicious javascript

Here's the description of Daniel's AppSec 2014 presentation:

Christine Barry

Connect with Christine on LinkedIn and follow her on Twitter here.

https://blog.barracuda.com

Spam targeting tax professionals automatically installs malware

June 29, 2011 by Barracuda Labs

by David Michmerhuizen & Luis Chapetti – security researchers

The criminal gangs that distribute the password stealing Trojan.Zeus have altered their spam campaigns in a frightening new direction. Already seen targeting their emails at credit point-of-sale users and wire transfer users, their latest spams are now crafted to appeal to tax preparation professionals by posing as an official IRS communication. What's even worse is that their payload isn't an attachment or a link to a download. Rather, the payload is a link to a Web site hosting an exploit kit that probes your computer's software and automatically installs the Zeus password stealer.

The messages don't give you much to be suspicious about at first. They come from a generic looking name and use the email-id of the recipient as the subject.

The text itself is very well written, as well it should be. It is an almost exact cut and paste of an IRS announcement from 2004. To be precise, IR-2004-67.

The item to examine closely is the link embedded near the bottom of the message. Although it says irs.gov, this link actually points to a set of malicious domains with vaguely official sounding names. In this case it's irsgovnews.com (warning: do not visit that domain in your Web browser!)

The job of these domains is to send Javascript to your browser to accomplish two things. First it displays a pop-up message saying that your browser cannot reach the site which is not true. The alert comes from the site itself! This is to keep you from suspecting what comes next.

What comes next is that the Javascript directs the browser off to another domain that hosts the Blackhole exploit kit. This kit sends specially crafted messages to the browser that try to take advantage of unpatched weaknesses in browser helpers such as Java or Windows Media Player.

If any weakness is found then Zeus is downloaded and installed automatically behind the scenes. Previous spam efforts required you to click “Run” in order to install the malware payload. The use of an exploit kit in this case means that Zeus is installed without user interaction. Once you click the link in the email, it's game over.

Visit www.barracuda.com for information on how to protect your business from these attacks.

Barracuda Labs

Huge amounts of Federal Reserve spam delivering Zeus password stealer

June 21, 2011 by Barracuda Labs

by David Michmerhuizen & Luis Chapetti – Security Researchers

Our spam monitoring systems at Barracuda Labs are following a very large spam campaign carrying Trojan.Zeus. The spam amounts are approaching many hundreds of thousands a day and although they are being delivered to a wide cross-section of Internet users, the content of the spams is aimed at users of online banking services.

When spam delivers malware, one of the most common strains it carries is the password-stealing Zeus Trojan. Zeus specifically targets banking passwords, and the gangs that distribute variants of this malware are especially interested in banking credentials belonging to small businesses and government agencies. Compared to the average consumer, these entities often have more money in their accounts and set higher limits on wire transfers. One thing small organizations don't always realize is that they do not enjoy the same protections against fraudulent transactions that consumers do.

The spams use graphics hosted by the Federal Reserve and pose as notices of a failed wire transfer:

Much like last weeks Chase Paymentech spam campaign, these notices are of particular interest to financial professionals. Unlike the more sophisticated Chase emails, these are a simple affair with poorly constructed text and no attempt at hiding the executable nature of the linked payload.

Still, there's the possibility that a busy executive might just skim the spam and click on the attachment, resulting in a Windows security warning:

While the spammers try to hide behind a double extension of .pdf.exe, this is no PDF. This is an executable program, and the Federal Reserve is not going to send you any vital information coded into a program. Don't run it.

If you do, you've installed Zeus:

It will run quietly in the background, intercepting browser traffic, watching for credentials and sending any it finds off to its command and control server.

Barracuda Networks customers using the Barracuda Spam & Virus Firewall are protected from these emails, while customers using Barracuda Web Filters or Barracuda Web Security Flex are protected from the payload.

Barracuda Labs

Fake Chase Bank invite delivers password stealer

June 17, 2011 by Barracuda Labs

by David Michmerhuizen & Luis Chapetti – Security Researchers

The spam monitoring systems at Barracuda Labs have uncovered an especially objectionable spam campaign that poses as a sign-up email from the Chase Bank credit card processing service Chase Paymentech.

We see lots and lots of spam at Barracuda Labs. Even if the sender isn't suspect, it is still generally easy to spot either because of the subject matter or flaws in the content.

What makes this spam dangerous is a combination of convincing content and deceptive payload. Examining this spam highlights the risk that comes with assuming one can always judge spam by its appearance alone.

These spams are particularly well done. The only suspicious element is that the From: address is not Chase bank, an unusual failure given how easy it is to fake the From: field in an email.

The email invites you to activate a credit card payment account and tells you that your first step is to find your merchant ID and user ID in the attached Microsoft Word document. That Word document is what indirectly delivers the malware payload.

Vulnerabilities in Microsoft Word have mostly been patched or mitigated, and it's been years since Word document attachments were something most users had to worry about. While users have become more suspicious of programs that must be downloaded and run, they're more likely to open a document which is “just something you read.”

Unfortunately, malware distributors have recently discovered that common vulnerabilities in Adobe's Flash player can be exploited by embedding the malicious Flash file into a Word document. This takes users who aren't likely to suspect a Word document of malicious intent and puts them at risk if they open it.

That's what happens here. If you open the attached merchant_info.doc, you can't see the Flash control embedded in the document. You really don't see much of anything for the minute or two that it takes the Flash code to download and install malware on your Windows computer.

Once the infection is accomplished, this Word document closes and you're back to staring at the email and wondering what went wrong. Meanwhile your computer is running Trojan.Zeus in the background.

Zeus quietly monitors your Internet traffic looking for username and password data. It saves them and periodically sends them off to control servers elsewhere on the Internet.

The content of this spam is of particular interest to financial professionals, making the installation of a password stealer that much worse. Trojan.Zeus has been implicated in many instances of online theft from small business accounts, especially since small business banking involves higher dollar amounts and does not carry the same level of theft protection as consumer accounts do.

The Adobe vulnerabilities that allow this to succeed have been used in a number of recent email attacks. We strongly recommend you upgrade all of your Flash installations by visiting http://get.adobe.com/flashplayer.

Barracuda Labs

Main navigation

Email Security

Highlighted Threat: