Email scam aims to drop Dridex on machines by impersonating FedEx, UPS

Hackers are sending spoofed emails that appear to be from FedEx, UPS and DHL as part of a mass emailing campaign meant to infect victims’ computers.

As more Americans rely on package deliveries during the coronavirus pandemic, scammers are trying to capitalize on the tracking process by sending spoofed emails containing malicious software.

Hackers are sending spoofed emails that appear to be from FedEx, UPS and DHL as part of a mass emailing campaign meant to infect victims’ computers, according to research initially published on May 5 by the security vendor Votiro. The messages appear to include package tracking updates, though at least some of them aim to infect recipients with a strain of malware known as Dridex, which is typically used to steal bank account data.

The messages usually ask recipients to download an invoice, or view their tracking information.

Code in the images, links and header of the email all appeared to be legitimate, providing the hackers with cover. They also disguised many of the messages to make them appear as if they arrived from a trustworthy corporate data center, such as a UPS billing center.

“The idea is to mask it as something that’s not bad,” said Richard Hosgood, a director of engineering at Votiro. “The [victim] wouldn’t even know that there’s something going on.”

Rather than including a malicious Microsoft Excel attachment in the email, researchers noted, the attackers in this case relied on code that beaconed to an external website. Victims then would be asked to enable “macros,” which are widely used commands in Microsoft apps, at which point a malicious file is downloaded instead of the seemingly innocuous Excel document.

While not totally unique, the hackers increasingly seem to be relying on outside websites to infiltrate victim machines, instead of booby-trapped email attachments, as part of an approach that Hosgood said was like the cyber equivalent of talking on a disposable burner phone to avoid detection.

“It was really smart,” he said. “They modified the code just slightly to avoid being recognized as a known threat by most anti-virus software.”

Hackers are avoiding detection by utilizing a relatively new tool called “Evil Clippy,” unveiled as a red team hacking tool by researchers in 2019. Other security firms also have detected he malicious use of Evil Clippy in recent months, including findings from Trend Micro which suggested that cybercriminals have adopted Evil Clippy as an evasion technique.

“It looks like a legitimate threat [and] the use of Evil Clippy takes it up a notch,” said Allan Liska, a threat intelligence analyst who reviewed the Votiro research. “[T]here has not been enough discussion of it.”

Attackers appear to have sent the first email in this fraud campaign on April 20. It appears to be aimed at a list of individual web users, rather than employees of a specific company, or customers of a single delivery service, Hosgood added. The number of victims affected was not immediately clear, he said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure