Last week in security news, researchers spotted a new attack campaign in which malicious actors leveraged trojanized versions of popular hacking tools to spread the njRat Trojan. Various other Trojan families made headlines, as well. Geost drew attention to itself by using unofficial webpages to target Russian banks, while the new Cinobi banking Trojan made its debut in an exploit kit campaign targeting Japanese users.

Top Story of the Week: njRat’s New Attack Campaign

Cybereason came across a new njRat campaign in which digital attackers trojanized hacking tools and installers. They then posted these modified tools on forums and websites in an attempt to bait other hackers into installing them.

When someone attempted to install one of those tools, the campaign pulled an njRat payload hosted on a compromised WordPress site. Successful installation of the malware gave attackers the ability to hijack a victim’s machine. At that point, they had the option of conducting secondary attacks like launching distributed denial-of-service (DDoS) attacks or stealing sensitive data.

Also in Security News

  • Unofficial Webpages Employed by Geost Trojan to Target Russian Banks: Researchers at Trend Micro observed digital attackers using webpages with randomly generated server hostnames to distribute the Geost banking Trojan. In doing so, these malicious actors directed Geost at users who lacked access to or chose to circumvent the Google Play store.
  • IQY Files Converted Into Delivery Mechanism for Paradise Ransomware: Lastline detected a spam campaign that attempted to trick users into opening an attached internet query (IQY) file. In the case that a user complied, the IQY file retrieved a malicious Excel formula from the attackers’ command-and-control (C&C) server and used it to install Paradise ransomware.
  • Phishing Scam Facilitated by Fake Customer Service Chatbot: In a new phishing scam campaign shared with Bleeping Computer, digital attackers programmed a chatbot to pose as a customer service agent and walk the victim through several screens designed to steal their data. The chatbot even asked victims to reenter their information as a double-verify mechanism.
  • Phone System Disabled by Durham, NC, Following Ryuk Attack: IT personnel for the City of Durham, North Carolina, decided to contain a Ryuk ransomware attack by temporarily disabling the municipality’s phone system. This decision disrupted Durham residents’ ability to contact several city services and facilities including Durham City Hall.
  • Adult Content Used as Lure to Spread Raccoon Malware: IBM X-Force came across an attack email in which malicious actors claimed to have hacked one of the victim’s friend’s accounts and discovered nude images of their girlfriend. The attackers then threatened to share those pictures with the friend’s contacts unless the recipient opened an attachment that secretly contained the Raccoon infostealer.
  • Japanese Banking Customers Targeted With Bottle EK, Cinobi Banking Trojan: Trend Micro discovered a new campaign called “Operation Overtrap” in which digital criminals leveraged phishing emails and the Bottle exploit kit (EK) to target Japanese banking customers. Those methods commonly led users to the new Cinobi banking Trojan.
  • Vulnerability in Exchange Control Panel Exploited by Threat Actors: Researchers at the U.K.-based firm Veloxity observed malicious actors crafting new attacks that exploited CVE-2020-0688, a vulnerability that affects Microsoft’s Exchange Control Panel. This discovery followed just weeks after the tech giant issued a patch for the security flaw.
  • Exploits Targeting IoT Devices With Mirai Surged in February 2020: In its “Most Wanted Malware” roundup for February 2020, Check Point Research revealed that it had spotted a surge in exploitation attempts targeting vulnerable internet of things (IoT) devices with the Mirai botnet. Many of those attacks specifically abused a “PHP php-cgi Query String Parameter Code Execution” vulnerability.

Security Tip of the Week: Review Your Domains’ Security Measures

Security professionals can help protect their websites against compromise by reviewing an asset inventory for all information concerning their domains. This inventory should include a rundown of the security measures that are in place to protect the organization’s domains against takeover attempts.

At the same time, infosec personnel should consider protecting their organizations against DDoS attacks by investing in a solution that’s powered by artificial intelligence (AI) and machine learning (ML) to dynamically detect attack attempts.

More from

More School Closings Coast-to-Coast Due to Ransomware

Instead of snow days, students now get cyber days off. Cyberattacks are affecting school districts of all sizes from coast-to-coast. Some schools even completely shut down due to the attacks. The federal government recently warned that K-12 schools face a growing threat from cyber groups. According to the FBI, school districts often have limited cybersecurity protections, which makes them even more vulnerable. The FBI also says it anticipates the number of threats to increase. In a recent warning, the nation’s…

The Role of Human Resources in Cybersecurity

The human resources (HR) department is an integral part of an organization. They work with all departments with a wider reach than even IT. As a highly visible department, HR can support and improve an organization’s security posture through employee training. Their access to employees at the start of employment is an opportunity to lay a foundation for a culture of risk awareness. HR departments do not typically include cybersecurity risk awareness training with new hire onboarding, but it’s something…

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…