続きを読む
Latest Intelligence for October 2016
Number of new malware variants rises to over 96 million and global spam hits highest rate in nearly a year.
続きを読む
続きを読む
Spam offering fake Visa benefits, rewards leads to TeslaCrypt ransomware
Spam campaign baits users with Visa Total Rewards emails containing malware that leads to Trojan.Cryptolocker.N infections.
続きを読む
続きを読む
Instagram Scam: Lottery Winners Impersonated to Offer Money for Followers
Over the last week, Instagram scammers have been posting images offering fake lottery winnings to followers. They have convinced users to share the posts, give up personal information, and even send money back to the scammers.
In this scam, a number of Instagram accounts have been created to impersonate real-life lottery winners from the UK and US. These accounts claim to offer US$1,000 to each Instagram user who follows them and leaves a comment with their email address.
Figure 1. Instagram accounts impersonating real-life lottery winners
The accounts impersonating lottery winners have been extremely successful, and have gained anywhere from 5,000 to 100,000 followers.
Once they have amassed a certain number of followers, they reveal a secondary Instagram account belonging to their “accountant”, who is in charge of delivering the US$1,000 to users—with a catch.
Figure 2. Fake “accountant” profiles asking users for money
The previous figure shows the “accountant” profiles asking Instagram users to send US$0.99 through a large payment processing service to cover the postage fees for mailing out the checks.
Figure 3. Users who have fallen for the lottery scam
Even though a number of red flags were present for users, the scam has proven to be a success. Each account has gained thousands of followers, with users willingly divulging their email addresses, and some users sending scammers US$0.99 for the supposed postage fees.
The main goal of this scam campaign was to collect accounts with thousands of followers for personal use or resale. During our research, we also found that user names associated with some of the impersonation accounts had performed an account pivot. This means the avatar, user name, and user biography section were changed to preserve the account from being flagged for spam. This allowed the scammers to continue to use or sell the account.
Figure 4. Instagram impersonation accounts have reappeared with fewer followers
Shortly after the account pivot, the impersonation accounts reappeared, but with fewer followers than before. One of the accounts even claimed that it was “hacked” and asked followers to be patient.
It’s clear that these accounts are fraudulent, but users continue to believe that they will be given US$1000 just for following Instagram accounts.
Symantec advises users with the following precautions:
- Do not believe everything you read, especially on social networking sites
- Be skeptical when you come across such offers. As we have previously pointed out, free stuff on social networks is not free
- Do not willingly give up personal information
- Do not send money to somebody you do not know or trust
Always remember that if it sounds too good to be true, it is.
Sochi Olympics Terrorism Fears Used as Bait for Targeted Darkmoon Campaigns
While the Sochi Winter Olympics may now be over without incident, considering all of the media attention and fears surrounding a potential terrorist attack at the event, it should come as no surprise that cyberattackers were preying on these uncertainties to target potential victims of interest.
During the games, Symantec saw multiple targeted email campaigns that used Sochi Olympics themes to bait potential victims. These observed email campaigns were blocked by our Symantec.Cloud service. In one such campaign, we saw that targets were being sent the following email.
Figure 1. Email purporting to relate to a terrorist threat at the Sochi Olympics
In this campaign, attackers were using the social engineering ploy of a terrorist threat at the Sochi Olympics to lure in their victims. While the email does not look professional, the curiosity for the content can still be enough to persuade an individual to open the attachment. If a victim fell prey to opening the attachment, their computer became infected with Backdoor.Darkmoon. Darkmoon is a popular remote access Trojan (RAT) which is often used in targeted attacks, as seen in a recent Symantec blog about how the G20 Summit was used as bait in targeted emails and in the 2011 Symantec whitepaper, The Nitro Attacks.
In another targeted campaign using the Sochi Olympics theme, we observed the following email that was being sent by an attacker to targets of interest.
Figure 2. Email purporting to relate to military co-operation at the Sochi Olympics
Again, as seen in the email, the attackers used the social engineering ploy of military co-operation around the Sochi Olympics. This time, the payload was Trojan.Wipbot. This Trojan is associated with another similar targeted attack campaign, which included an attack that used a Windows zero-day elevation of privilege vulnerability.
These attacks highlight the ongoing need for vigilance when receiving any unsolicited emails. They also reinforce what is already known — targeted attackers are quick to make use of the latest news or events to enhance the chances of success for their social engineering ploy. The campaigns also highlight how targeted email attacks are showing no sign of dissipating anytime soon.
As always, we advise customers to use the latest Symantec technologies and incorporate the latest Symantec consumer and enterprise solutions to best protect against attacks of any kind.