One Nigerian man's simple phishing campaign drains thousands from corporate coffers

"The malware he uses is old, generic and readily available online," the researchers wrote.

One Nigerian man, working alone and using old malware, launched an email-based campaign that successfully stole thousands of dollars from manufacturing, banking and construction companies around the world.

A new report from Check Point Software Technologies spotlights a low-sophistication campaign of business email compromise (BEC) attacks against 4,000 global companies in the last four months. Security researchers say they traced the attacks back to a single individual in his mid-20s aiming to infect networks, steal data and commit fraud.

The thousands of attempts have resulted in 14 companies being infected. Nigerian and international law enforcement were informed a month ago, Check Point threat intelligence manager Maya Horowitz told CyberScoop, but it’s not clear if any action has been taken.

The attacker uses the phrase “get rich or die trying” on social media accounts, the researchers said, lending that name to the case study.

The attacker uses fake addresses appearing to come from Saudi Aramco, the second-largest daily oil producer in the world, to send malware-laced phishing emails to financial staff at a wide range of global firms and industries. Check Point offered an overview of successfully infected companies, including a marine and energy solutions company in Croatia, a transportation company in Abu Dhabi, a mining company in Egypt, a construction company in Dubai, an oil and gas firm in Kuwait as well as a construction organization in Germany.

“Unfortunately it is pretty common,” Horowitz said. “As long as potential targets, which is everyone, don’t practice the necessary cautions and security measures, it will keep on being way too easy to throw a successful malware campaign.”

The unnamed attacker uses NetWire malware, a remote access Trojan (RAT) first launched in 2012 and available publicly around the web. Like any RAT, it allows control over an infected machine and steals important data like passwords that can then be used for profit. NetWire is a subscription-based RAT that attracts criminals because it doesn’t watermark data files which could be used to trace malware back to the attacker. He also uses Hawkeye for keylogging, a notoriously simple piece of malware sold on black markets and available for free on the open internet.

“The malware he uses is old, generic and readily available online,” the researchers wrote. “And he uses freeware to ‘scrape’ email addresses from corporate websites which he then uses as targets for his campaigns. The fact that the campaign was still effective, despite using only basic cyber-criminal techniques, highlights just how much of a problem these business email compromise attacks have become.”

This Nigerian scam rests, in virtually every way, on the small end of the scale when measuring cyberattacks and BEC campaigns. Earlier this year, a Lithuanian man named Evaldas Rimasauskas was arrested for a $100 million BEC scam that dented Google and Facebook when employees at both Silicon Valley giants sent money to foreign bank accounts after the attacker allegedly impersonated the Taiwanese electronics manufacturer Quanta Computer.

Nevertheless, the success of the thousand-dollar scam highlights how potent the threat has become. In a 2016 report, the FBI said BEC attacks cost over $1 billion per year on average, a number that’s rising, and cost victims between $25,000 and $75,000 per attack.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure