Threat Source newsletter (June 24, 2021)
Summary: The FBI estimates business email compromise cost victims around $1.8 billion in 2020, and Cisco Talos reports recent campaigns in which attackers take over business email accounts and send employees and customers messages themed around COVID-19 and PlayStation 5 sales. Talos also describes an Agent Tesla remote access trojan campaign using COVID-19 vaccine schedule phishing documents with an RTF attachment that exploits Microsoft Office vulnerability CVE-2017-11882, and cites a Proofpoint report that APT groups buy network access from independent adversaries and share in ransomware proceeds, including a group named TA577 active since mid-2020 that has used SmokeLoader, IcedID, Ursnif and Cobalt Strike.
Why it matters: Business email compromise cost victims an estimated $1.8 billion in 2020, and the access brokers feeding ransomware crews mean the intrusion that lands on your network may be sold to another group before you notice it.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2017-11882
- Related