Forest Global Training Partners

Cyber Risks · Krebs on Security

Wipro Intruders Targeted Other Major IT Firms

Summary: KrebsOnSecurity reported that the phishing campaign which compromised more than 100 Wipro systems and dozens of employees also left traces pointing at other IT providers, with subdomains on the malicious domain internal-message[.]app naming Infosys, Cognizant, Capgemini, Rackspace, Avanade, PCM, Sears, Elavon and Green Dot, all resolving to an address owned by Russian bulletproof host King Servers. Investigators believe the intruders installed ScreenConnect on each compromised Wipro system and used it to connect remotely into Wipro client systems, and a source said the group's goal was gift card fraud, mirroring a 2016-2017 campaign in which Maritz Holdings sued Cognizant over more than $11 million in fraudulent eGift cards.

Bottom line: The access was not the objective: a source said the intruders used their foothold at Wipro to commit gift card fraud at a large U.S. retailer's stores, and the earlier Cognizant-linked case produced more than $11 million in fraudulent eGift cards. Krebs also noted that many antivirus vendors still were not flagging the listed domains and addresses as malicious.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related