(Subscribe to our Today's Cache newsletter for a quick snapshot of top 5 tech stories. Click here to subscribe for free.)
The recent territory disputes between India, China, Pakistan and Nepal came in handy for a cybercrime group SideWinder. It launched phishing and malware attacks using territory dispute themes to lure users.
The group’s target include multiple government and military units, primarily in Nepal and Afghanistan, researchers at Trend Micro, a cybersecurity firm, said in a report.
They found a server used to deliver malicious LNK file and host multiple credential phishing pages, which were copied from victims’ webmail login pages and modified for phishing.
After the gathered credentials are sent, some of the phishing pages redirect victims to different documents or news pages with themes related to COVID-19 or territory disputes between India and neighbouring countries.
SideWinder group has become famous for targeting countries in the South Asian region. The group had previously launched attacks against Pakistan, Bangladesh, and China using lure files related to COVID-19.
Trend Micro collected different samples from the campaign and found that all cases either downloaded or dropped files, and then executed JavaScript code to install the main backdoor + stealer.
“Although it’s not clear to us how these phishing pages are delivered to the victims, finding the original webmail servers that they copied to make these phishing pages allows us to identify who they were targeting,” researchers noted.
