Malware Attack Targets Defense Exporters
A multi-step attack targeting defense exporters was recently reported on Symantec’s security blog. This ploy first invaded one defense contractor’s network where it set up a directory on the system for fake press releases. The invaded network was then used to send emails from that network to employees of a second defense contractor. Those emails reported (falsely) that the CEO of the second defense contractor had been arrested for violations of the Export Administration Act and contained a link back to the fake press release directory on the first contractor’s website. Clicking that link would deliver the payload to the user’s computer.
Often these malware attacks originate outside the United States from people whose proficiency in English grammar and spelling is on the severely limited side, thereby providing the first clue that something is amiss. (If cybervillains could speak decent English, after all, they could probably get real jobs.)
