News Coverage

RiskIQ reports another phishing campaign, but in this case Turkish enterprises are the victims. An unidentified espionage operator has been prospecting Turkish defense contractors with malicious email attachments that carry the Remcos RAT. Remcos performs a typical array of spyware functions-keylogging, screenshot capture, audio and video recording-as well as common RAT functionality permitting it to manage files and programs. One unusual capability: SOCKS5 proxying, which lets the controller turn victims into network proxies, thereby hiding its real command-and-control server.

Regions of the world in geopolitical turmoil, like Turkey, are prime targets for cyber espionage campaigns. Starting in mid-November, an unknown actor purporting to be from the tax collection arm of the Turkish government began a spear phishing campaign against a Turkish defense contractor. The group used tactics that have become extremely useful for cyber spies—spear phishing emails that social engineer the victim to download an attached or embedded file and then enable macros. These macros contain executable files that download a Remote Access Trojan (RAT), which can log keystrokes, take screenshots, record audio and video from a webcam or microphone, and install and uninstall programs and manage files. RiskIQ identified multiple employees within the targeted organization that were affected. The first email we were alerted to was sent on November 16 at around 6 a.m. The email, which we censored from victim PII, looked like this:

Digital threat management firm RiskIQ is out with a report that smartphone Apps are a hotbed for scams and hackers in the cryptocurrency space. Having reviewed 18,408 Apps across 20 different App stores, RiskIQ says it has uncovered 661 “blacklisted” Bitcoin Apps allowing crooks to steal money and personal data. The company says users of Apple (yes, Apple), Google Play, SameAPK and APKPlz are at risk.

The Apple and Google application stores hold hundreds of fraudulent cryptocurrency applications hidden amongst the legitimate ones, according to a report from CNBC. Cybersecurity firm RiskIQ looked at over 18,000 apps and found that 661 blacklisted cryptocurrency apps were found across 20 app stores, including Apple’s App Store, and Google Play. The latter has more than 272 blacklisted applications available for download.

With increasing interest in cryptocurrency it’s inevitable that cyber criminals will see the potential to make money from investors and users. Threat management company RiskIQ has found that hackers are targeting the Apple, Google Play, SameAPK, APKPlz and other app store users with malicious cryptocurrency apps aiming to steal money and personal data.

An unknown actor purporting to be from the tax collection arm of the Turkish government has been carrying out spear-phishing campaigns against Turkish defense contractors. According to RiskIQ, the perpetrators have been targeting multiple people inside a given organization since November 2017 with weaponized documents that download a remote access Trojan (RAT) named Remcos. Remcos can log keystrokes, take screenshots, record audio and video from a webcam or microphone, install and uninstall programs, and manage files. Interestingly, it also has SOCKS5 proxy capabilities: An operator can turn the victims of the crime into proxies for its own network, hiding the real C2 server.

Jordan Herman, Threat Researcher at RiskIQ: Google Play has reduced the number of malicious apps in its stores, but its protections remain circumventable with relatively simple tricks such as encrypting malicious code, delaying execution of malicious code, or using social engineering in-app to trick users into downloading malicious apps from the attackers’ own servers. Google can address this via a fundamental shift of the Play Store from open to closed, locking it down and more intensively scrutinizing apps and updates. However, I’m certain there’s a contingent of users who would oppose such a move as the openness of Android is what attracted them in the first place.

Threat prevention, as the name implies, stops an attack before it occurs. This typically includes services like penetration testing, simulated attacks and system hardening. 30% of the cyber security insurtechs in Innovator’s Edge are assisting insurance providers with these activities. RiskIQ, for example, uses big data, analytics and simulations. The company’s RiskIQ Digital Footprint maps all your IT assets and determines if they are hardened from a security standpoint.

As in previous years, Tech Pro Research has collated a large number of turn-of-the-year predictions in order to get an overview of the cybersecurity landscape as 2018 gets underway. All of these predictions were made before the biggest security story in years broke, in the first week of January — the Spectre and Meltdown processor vulnerabilities, caused by exploitable flaws in modern CPU design.