Quasar

Venom

Threat actor TA558 has launched a new phishing campaign targeting Latin American sectors with Venom RAT, amid rising cyber threats exploiting DarkGate and malvertising. 
Cybergang TA558 is once again targeting Latin American companies and government agencies in what appears to be a massive phishing campaign aimed at installing Venom RAT, a remote access trojan. 
First <a href="http://www.linkedin.com/feed/update/urn:li:activity:7180255262807572480?data=hfsiyucryptoy87enewsg89diub" target="_blank" rel="noreferrer noopener">reported</a> by Idan Tarab, a threat analyst at Perception Point, the campaign casts its net wide, targeting industries in Spain, Mexico, the U.S., Colombia, Portugal, Brazil, the Dominican Republic, and Argentina. Although it remains uncertain if any crypto company based in Latin America fell victim to a breach orchestrated by TA558, Tarab stressed the extensive reach of the campaign, which spans beyond hotels and travel agencies to encompass fintech, manufacturing, and industrial enterprises. 
According to Tarab, the latest attack chain utilizes phishing emails as the primary means of initial access, with Venom RAT being dropped subsequently. This particular strain, a derivative of Quasar RAT, is equipped with functionalities enabling the extraction of sensitive data (e.g. passwords, photos, financial records, and etc.) and remote system control. 
TA558, known for its activities since at least 2018, has a history of focusing on entities within the Latin America region, employing a range of malware including Loda RAT, Vjw0rm, and Revenge RAT. 
 You might also like: <a href="https://crypto.news/over-46m-lost-to-crypto-phishing-in-february-social-media-impersonations-at-fault/"> Over $46m lost to crypto phishing in February, social media impersonations at fault </a> 
Earlier this year, cybersecurity researchers found a new phishing toolkit dubbed CryptoChameleon, targeting Federal Communications Commission employees and staff of crypto firms including Coinbase, Binance, Gemini, Kraken, ShakePay, and Trezor. 
As <a href="https://crypto.news/hackers-target-coinbase-binance-staff-with-phishing-clones-of-gmail-icloud/" target="_blank" rel="noreferrer noopener">detailed</a> by analysts from Lookout, the attackers employ sophisticated social engineering tactics, leveraging convincing single sign-on pages mimicking authentic ones from Okta, a cloud service provider for authentication. This multi-stage assault encompasses emails, SMS, and voice phishing to coerce victims into divulging crucial credentials and sensitive information, primarily in the U.S. 
 Read more: <a href="https://crypto.news/trader-loses-over-674k-to-phishing-scam/"> Trader loses over $674K to phishing scam </a>

Cybercrime group TA558 strikes phishing campaign against Latin America-based companies

crypto.news

2024年4月2日公開の他の記事

Unlocking Visual Creativity: Using Gemini AI to Enhance Your Google Slides Presentations

New Cryptocurrency Releases, Listings, & Presales Today — GrabPenny, CogniTechAI, MindVerse

Easter Weekend Brings USDT & BNB Investors to Fezoo Presale for Rapid Growth

Analysts Predict BlockDAG Presale to Make $5M a Day Outshining Uniswap Price Prediction & PUSHD’s...

US Government Profits Over $2 Billion Selling Silk Road Confiscated Bitcoins

Introducing Moonriver Coin: The Ethereum-Compatible Smart Contract Platform on Kusama

ニュースレターを購読して暗号資産の最新情報を毎日入手！