Organized Crime Adapts Malware To Self-Replicate

Organized crime has been in the cybercrime business for quite some time. Now, they are taking malware adaptation to a whole new level of bad. According to the security company ICEBRG, the crime group FIN7, has revised malware to self-replicate and make itself undetectable using most available cyber defense tools. Adding insult to injury, it infiltrates victims’ Microsoft Outlook autocomplete feature to steal email addresses for additional phishing attacks.

All it takes is for one employee at any company to click a malicious link or attachment to set malware like the one FIN7 uses into action. Security and awareness training is any organization’s best defense against attacks like these. This particular attack starts with phishing and once a victim is found, a backdoor called HALFBAKED is implemented and the attack continues.

While having perimeter security tools in place such as firewalls, antivirus, and intrusion detection systems are important, employees should be trained continually on current attacks and mitigation.

When training to look for phishing, a few identifying factors will still give it away:

• A sense of urgency is presented that they need to do something immediately
• The sender is unknown
• Links or attachments in the message are unexpected, even if the sender is known
• The language used is not grammatically correct
• The message is unprofessionally written

A thorough program should include training as well as a testing process so that any weaknesses with the knowledge of the staff or the program can be addressed and corrected.

Don’t forget to remind everyone that phishing doesn’t only come in the form of email anymore. SMS or text phishing (smishing), popups, malvertising, and even phishing via the telephone (vishing) are still occurring on a regular basis.