Categories: Ad Guardian PlusNews

Hackers attack Germany, Italy and US

Security researchers tracked activities of a new group of financially-motivated hackers. So, the hackers target a few companies and organizations in Germany, Italy, and the United States. And they try to infect them with backdoor, banking Trojan, or ransomware malware.

The attackers are more interested in manufacturing, healthcare industries and IT services that store critical data. Because they count on the fact that people who have their data here can afford high ransom payouts.

Hackers pretend to represent government entities asking for taxes or refunds, according to a ProofPoint report. And they usually send out low-volume emails. Also, researchers mention that: “Tax-themed Email Campaigns Target 2019 Filers, finance-related lures have been used seasonally with upticks in tax-related malware and phishing campaigns leading up to the annual tax filing deadlines in different geographies.”

A DOC file compromises computers

The hackers use a malicious Word document attached as the first step to compromise devices. When users open the document, it executes a script to run PowerShell commands. Then, they download and install ransomware, a Trojan or a backdoor.

The specialists explain that “Opening the Microsoft Word Document and enabling macros installs Maze ransomware on the user’s system, encrypting all of their files, and saves a ransom note resembling the following in TXT format in every directory.”

Christopher Dawson,

Christopher Dawson, Threat Intelligence Lead at Proofpoint, told The Hacker News that “Although these campaigns are small in volume, currently, they are significant for their abuse of trusted brands, including government agencies, and for their relatively rapid expansion across multiple geographies.”

Also, hackers

use lookalike domains, excessive technical writing and stolen branding, to be more convincing:

  • Bundeszentralamt fur Steuern, the German Federal Ministry of Finance,

  • Agenzia Delle Entrate, the Italian Revenue Agency,

  • 1&1 Internet AG, a German internet service provider,

  • USPS, the United States Postal Service.

The minimum protection against cybercriminals

Although they use well-known tools and techniques, these still work very well and let criminals gain access to organizations.

The basic online security steps would be:

  • disable macros from running in office files,

  • keep a regular backup of the important data

  • run one of the best antivirus software

  • never open email attachments from unknown/untrusted sources.

  • Avoid clicking the links from unknown sources.

Laurentiu Titei

View Comments

Recent Posts

Fixed: Something Went Wrong 1001 Error on Windows 11 and 10

If you are also getting the Microsoft Something Went Wrong 1001 or Error Code 1001…

3 days ago

How to Fix Mouse Cursor Disappears on Windows 10/11

If you also feel that the touchpad cursor disappears/the mouse cursor disappears on a Windows…

4 days ago

How to Add or Remove Programs on Windows 10 and 11

If you want to know how to add or remove programs to and from Windows…

5 days ago

How to Download ViGEm Bus Driver Safely for Windows 11,10

If you want to download and update the ViGEm bus driver safe then you can…

6 days ago

How to Fix bootrec /fixboot Access is denied Error in Windows 11

If you are getting the bootrec /fixboot access is denied error on the Windows 11/10…

7 days ago

How to Force Close a Program without Task Manager in Windows 11, 10

If you wish to know how to force close a program without the Task Manager,…

1 week ago