In the first 10 months of 2023, 20% of attacks on Russian companies occurred using legitimate logins and passwords from utilities. Oleg Skulkin, head of the BI.ZONE cyber intelligence department, told socialbites.ca.
According to Skulkin, attackers obtain the credentials of employees of Russian companies using phishing emails with attachments, often in the form of custom malware (malware). Most often, malware is either a thief (a program for stealing passwords from infected devices – editor’s note) or a remote access tool.
“Phishing emails remain one of the main methods of gaining initial access during targeted attacks. We discovered how attackers compromised up to 400 companies using a malware-based email campaign. Attackers mostly use thieves and remote access tools “He distributes it this way,” he said.
The expert explained that within the scope of this attack, employees received a letter from a person who introduced himself as a potential business partner or customer. He added a malicious attachment and asked him to open it to see and confirm whether products suitable for the order were available.
“The sender also wanted to confirm the delivery dates specified in this document. The letter included a request that this be done immediately. The person opened the document and then the malware was installed on the computer,” Skulkin explained.
According to him, attackers have easy access to malicious programs, these programs are increasingly distributed using the malware-as-a-service model, that is, cybercriminals for a fee buy the malware from the developer for a while or forever. The expert emphasized that this distribution method allows even technically untrained criminals to carry out successful attacks.
Previously Russian companies warned It’s about a new type of devastating DDoS attack.