Quasar

Venom

Threat actor TA558 has launched a new phishing campaign targeting Latin American sectors with Venom RAT, amid rising cyber threats exploiting DarkGate and malvertising. 
Cybergang TA558 is once again targeting Latin American companies and government agencies in what appears to be a massive phishing campaign aimed at installing Venom RAT, a remote access trojan. 
First <a href="http://www.linkedin.com/feed/update/urn:li:activity:7180255262807572480?data=hfsiyucryptoy87enewsg89diub" target="_blank" rel="noreferrer noopener">reported</a> by Idan Tarab, a threat analyst at Perception Point, the campaign casts its net wide, targeting industries in Spain, Mexico, the U.S., Colombia, Portugal, Brazil, the Dominican Republic, and Argentina. Although it remains uncertain if any crypto company based in Latin America fell victim to a breach orchestrated by TA558, Tarab stressed the extensive reach of the campaign, which spans beyond hotels and travel agencies to encompass fintech, manufacturing, and industrial enterprises. 
According to Tarab, the latest attack chain utilizes phishing emails as the primary means of initial access, with Venom RAT being dropped subsequently. This particular strain, a derivative of Quasar RAT, is equipped with functionalities enabling the extraction of sensitive data (e.g. passwords, photos, financial records, and etc.) and remote system control. 
TA558, known for its activities since at least 2018, has a history of focusing on entities within the Latin America region, employing a range of malware including Loda RAT, Vjw0rm, and Revenge RAT. 
 You might also like: <a href="https://crypto.news/over-46m-lost-to-crypto-phishing-in-february-social-media-impersonations-at-fault/"> Over $46m lost to crypto phishing in February, social media impersonations at fault </a> 
Earlier this year, cybersecurity researchers found a new phishing toolkit dubbed CryptoChameleon, targeting Federal Communications Commission employees and staff of crypto firms including Coinbase, Binance, Gemini, Kraken, ShakePay, and Trezor. 
As <a href="https://crypto.news/hackers-target-coinbase-binance-staff-with-phishing-clones-of-gmail-icloud/" target="_blank" rel="noreferrer noopener">detailed</a> by analysts from Lookout, the attackers employ sophisticated social engineering tactics, leveraging convincing single sign-on pages mimicking authentic ones from Okta, a cloud service provider for authentication. This multi-stage assault encompasses emails, SMS, and voice phishing to coerce victims into divulging crucial credentials and sensitive information, primarily in the U.S. 
 Read more: <a href="https://crypto.news/trader-loses-over-674k-to-phishing-scam/"> Trader loses over $674K to phishing scam </a>

Cybercrime group TA558 strikes phishing campaign against Latin America-based companies

crypto.news

2024年4月2日公開の他の記事

BitMart and Banxa Collaborate to Unveil the Initial Matchless BMX Buyout Service

BONE Price Prediction: Is BONE Anticipating a Major Fall Ahead?

Latest DeFi Innovation (cFyF) Could Attract Even More Ethereum Users To Octoblock

The Latest DeFi Marvels: What’s New and Why It Matters

Pepe Coin Investors Eye Trends, FET Wavers, BlockDAG’s Whitepaper V2 Ignites Market Buzz

6 Best Altcoins to Invest in Right Now April 2 – Core, Bittensor, Maker

ニュースレターを購読して暗号資産の最新情報を毎日入手！