Phishing With A RAT Gives Access To Hackers

It’s perfect weather to go phishing again. That’s what some with less than angelic intentions believe anyway. Malware is being spread around using the popular method for getting information out of unsuspecting users. A massive campaign was discovered by security company Proofpoint where a remote access trojan (RAT) is set free on Windows PCs if email recipients open a .ZIP file containing the malware. It uses the leaked source code of a popular remote desktop app called Ammyy Admin to wreak its havoc, which is why this attack is being dubbed FlawedAmmyy.  If the cybercriminals gain access to the computer, they get full access to it and can steal files, login credentials, and much more.

The subject lines of emails in the phishing attack could be related to invoices, receipts, or a bill related to some transaction. The ZIP contains .url files designed to send users to a malicious website where a browser is launched. Then, they connect to a file:// link as opposed to what one would suspect to be a secure https:// file. If it’s opened, the RAT will run rampant on the network and give the hackers access to the PCs.

As always, watch for attachments or URLs in email messages that are not anticipated or are from unknown senders. Also, take a minute to check any of these that arrive just to be sure. Just because you are expecting something, no longer guarantees that isn’t malicious. A few recent examples of hackers infiltrating email conversations and using them to take advantage have reared their ugly heads. If you have any doubt, pick up the phone and call the sender to be 100% positive before clicking.

Although it’s unlikely any user affected by these will even be able to tell, if you do suspect your PC is behaving abnormally, contact your manager or IT department right away.

Researchers have said this is the first time malware has combined JavaScropted over a Server Message Block (SMB) protocol. The technical details are not what is important here. However, it just shows again how malware creators are continually finding new ways to get into corporate networks.