Hackers using PRISM-phishing Java RAT to steal government data
Cyber criminals are targeting government agencies with phishing messages containing a dangerous Java remote access tool (RAT).
Symantec researcher Andrea Lelli reported uncovering the threat, confirming that the messages are designed to entice government workers to download the attachments by masquerading as news announcements and messages about the PRISM scandal.
"We recently came across an attack campaign which looked quite unusual compared to the standard attacks normally seen in the wild. This campaign is targeting government agencies by sending phishing emails with a malicious attachment. Nothing new so far, except for one thing: the malicious payload is a Java remote access tool (RAT)," wrote Lelli on a company blog. "As we all know, cyber criminals tend to use recent hot media topics to entice users. In the case of this campaign they are using the recent news coverage surrounding the NSA surveillance programme PRISM."
