|
|
Posted on 4/4/2015 9:21:09 PM
|
|
|
On April 4, it was reported that IBM has uncovered a sophisticated scam manipulated by a well-funded Eastern European cybercriminal group, using "phishing", malware and phone calls. According to IBM, the organization defrauded more than $1 million from large and medium-sized companies in the United States through this scam.
IBM security researchers call the scam "The Dyre Wolf," which is smaller in scale than the recent widespread online fraud, but has reached a new level of sophistication.
According to IBM, criminals have been targeting employees of American companies since last year, spamming them with unsafe attachments, thus planting variants of the Dyre malware on as many computers as possible. Once implanted on a computer, the malware temporarily stops until the user logs in to the bank's website, instantly creating a fake screen that tells the user that something is wrong with the bank's website and asks them to call a specific phone number.
If the user does dial this number, there will be an English-speaking operator on the other end of the phone who already knows which bank the user wants to contact. The operator then induces the user to reveal the details of their bank account and immediately initiates a large wire transfer to transfer money from the account.
Caleb Barlow, vice president of security at IBM, said the scam was unique in using "living human" operators.
"What sets this case apart is that the attacker uses a whole set of social engineering techniques, which I think is unprecedented." Barrow said. "The scam focuses on large wire transfers, which really makes us look sideways."
IBM did not disclose details such as which companies fell victim to the scam or the specific location of the criminals.
Once the wire transfer is completed, the money in the scammed's bank account is quickly transferred between banks to avoid being chased. In one case, IBM said the cybercriminal group launched a denial-of-service attack on a targeted company, resulting in the company not finding out it was attacked until much later.
IBM Security recommends that companies ensure that their employees are well trained to detect phishing attacks and teach them to never give out bank account information to anyone.
|
Previous:Teach you how to view Baidu Tieba hidden dynamic users' speech recordsNext:My girlfriend owes me 4 yuan, and she doesn't plan to pay it back, should I break up?
|
