Security Market Segment LS
Wednesday, 27 July 2016 10:44

PayPal accounts being used for Chthonic Trojan

By

To get around ransomware and other trojan detection methods, cyber criminals have turned to PayPal, using its money request transfer system to distribute the Chthonic Trojan.

Global security vendor Proofpoint says the message from PayPal is legitimate – it is a “You’ve got a money request” that comes from PayPal. The sender does not appear to be faked: instead, the spam is generated by registering with PayPal (or using stolen accounts) and then using the portal to request money.

Email clients like Gmail and others don’t block legitimate PayPal emails – because they are not spoofed. The malicious URL is included in a kosher looking note that purports to provide proof of the transaction request.

Clicking on the link has two effects – it debits your account for $100, and it infects your Windows system with the Chthonic Trojan.

Proofpoint researchers also noticed that Chthonic would also download another module called AZORult. At this time, there are no details on what this module does, and Proofpoint researchers are still investigating its code.

Kevin Epstein, Proof Point’s vice-president, threat operations, said, "This isn't the first time that we've seen threat actors use legitimate services to distribute malware. However, this attack is carefully engineered to not just bypass traditional defences because the messages come from PayPal but also to trick users into paying and clicking through malicious links.

"These kinds of threats are difficult to catch at the client level. Instead, organisations need to be able to dynamically scan URLs at the network/email gateway and detect communication with command and control infrastructure. Of course, user training should come into play as well."

While the campaign is low intensity at this stage, it appears that we cannot trust any organisation that communicates via email – that bodes well for Australia Post and the humble, not so cheap, letter or Telstra and faxes!

Read 2458 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here




ELASTICON SYDNEY 2024 LATEST ADVANCEMENTS IN GENERATIVE AI

On 20 February, keynote addresses from NAB, Canva, AWS, and Google Cloud, among others, will feature at ElasticON Sydney 2024.

This event will explore the latest advancements in generative AI

The one-day conference, hosted by leading search analytics company Elastic, will include networking drinks, hands-on labs, technical sessions and a stellar line-up of keynote speakers from finance, technology, and government e=sectors.

ElasticON Sydney 2024 promises to be an enriching experience with a comprehensive exploration of the latest developments in security, observability, generative AI and their real world applications

Don't miss out on this opportunity to network and find answers for what's next from your industry peers and leaders


Register for ElasticON Sydney 2024

REGISTER HERE!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!

BACK TO HOME PAGE
Ray Shaw

joomla stats

Ray Shaw ray@im.com.au  has a passion for IT ever since building his first computer in 1980. He is a qualified journalist, hosted a consumer IT based radio program on ABC radio for 10 years, has developed world leading software for the events industry and is smart enough to no longer own a retail computer store!

Share News tips for the iTWire Journalists? Your tip will be anonymous

Subscribe to Newsletter

*  Enter the security code shown:

WEBINARS & EVENTS

CYBERSECURITY

PEOPLE MOVES

GUEST ARTICLES

Guest Opinion

ITWIRETV & INTERVIEWS

RESEARCH & CASE STUDIES

Channel News

Comments