Exploiting Fear as a Threat Actor

One of Libraesva’s Security Researchers recently discovered, along with other security vendors, targeted phishing and whaling campaigns all based around the Coronavirus outbreak, we don’t believe in playing on the fear, but its always good to see how these attacks work and why they work.

Figure 1 shows the email in question we received and blocked, the attackers in this case pretended to be the director of Milan University, warning internal users of the outbreak and steps to take to prevent further spread. As it turns out in fact, the email was spoofed and sent by a trusted sender from a fellow university, typical whaling attack, instead this time the call to action wasn’t transferring funds, but instead helping fight this infectious disease.

Figure 1 – Email Spoof of Director of Milan University, sent from a University of Bologna compromised account.

The interesting thing about this attack is that the sender of the email is trusted by the university and states on many occasions about the dangers of the virus 2019-nCoV as a respiratory epidemic, the call to action here is to quickly, look into the attached document which is a simple docx file with a link shown in Figure 2.

Figure 2 – The Document “Documento condiviso dell’Universita di Milano.docx” Attached.

Here in Figure 2 we can see the document in all its glory, feigning the need to access the file via a link which takes you to the screen in figure 3, obviously trying and failing to spoof an Office 365 login page

Figure 3 – The landing page when following the link from the attached document

Once Download file is selected you can clearly see when this becomes a true phishing scam, asking for passwords.

Figure 4 – After selecting download file, we can clearly see credential harvesting fields.

The Coronavirus is a great opportunity for any hacker worth their salt, but there are a few essential things considered when Libraesva decides that this is malicious

How we spotted it:

Whaling Protection: Our first observation was that the Director of Milan University is in our Business Email Compromise protection list, so we took additional checks to stop this user’s name and email being used against their own organisation. Effectively protecting this specific customer from any BEC/Whaling Attacks

Adaptive Trust Engine: Next we saw that the trust between these two organisations was quite high using the Adaptive Trust Engine’s relationship monitoring, but the trust between the two individual user’s was low, we didn’t let the organisational trust get in the way of understand the true nature of the email.

Sandboxing: Libraesva’s uniquely designed and built-in sandboxes disarm any docx, xlsx and pdf documents creating zero risk files meaning this attack, even if delivered to user’s would be unable to ex-filtrate information due to there being no links, no code, nothing in that document.

To Conclude:

Hopefully you learnt a little bit about how these business email compromise attacks look, and how threat actors work off the fear that the public have, Libraesva spotted this early and stopped it from reaching anyone. Thanks for reading and let us know if you have any questions at all.