45
57
42
42
42
30
45
60
30
45
30
57
TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks
TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.
Unit 42 identified a TrickBot distribution campaign on November 7-8, 2019, using payroll and annual bonus-themed emails sent from likely compromised .edu addresses through the legitimate SendGrid email delivery service. Emails contained links to Google Docs documents linking to downloader executables hosted on Google Drive, further masked behind SendGrid click-tracking URLs. The downloaders, signed by PERISMOUNT LIMITED and displayed with Microsoft Word icons, show a decoy pop-up and retrieve TrickBot payloads from compromised legitimate domains such as savute[.]in and lindaspryinteriordesign[.]com. The newer TrickBot variant stores its files and configuration under %APPDATA%\cashcore.
50
45
57
60
57
Payroll system of mosques, madrasahs hit by ransomware; staff details potentially compromised
Ransomware hit Avelogic's SmartHRMS payroll system serving Singapore mosques and madrasahs under MUIS, potentially exposing staff details.
The SmartHRMS human resources and payroll system used by mosques and madrasahs overseen by Singapore's Islamic Religious Council (MUIS) was hacked and held for ransom. The system is supplied by Singapore-based software vendor Avelogic, which posted a cybersecurity incident notice on its website. Staff details are potentially compromised, according to The Straits Times.
48
30
30
42
57
30
45
57
57
45
30
42
57
30
30
60
60
30
30
42
60
60
30