MitM attackers posing as banks, other major groups, tough to detect

Share this article:
Hackers are compromising online banking and social media users in a MitM attack campaign.
Hackers are compromising online banking and social media users in a MitM attack campaign.

Hackers are compromising online banking and social media users in a man-in-the-middle (MitM) attack campaign that involves posing as major organizations – and they are doing it without setting off alerts, according to researchers with PhishLabs.

More than 70 recognizable financial organizations around the globe have been targeted so far in the campaign, according to PhishLabs research, which adds that attackers posed as more than 25 other major websites for the purposes of gathering credentials, including social media and email.

The attack begins as many do – with spam.

The PhishLabs researchers observed spam emails containing RTF files – named ‘Authorization Form,' or something similar, to lure the user into opening it – that are actually backdoor Remote Administration Tools (RAT) that surreptitiously execute upon being clicked.

Upon execution, the malware reconfigures the DNS settings on the infected PC so that it uses the DNS server controlled by the hacker, Don Jackson, director of threat intelligence with PhishLabs, wrote in a Wednesday post.

“The DNS changes point to the hacker's clandestine DNS name server so that users are directed to proxy servers instead of legitimate sites,” Jackson wrote, explaining the malware also installs “a root certificate for a rogue [Certificate Authority]” so that the user is not alerted by error warnings.

With all that in place, the attacker can now pose as any site of their choosing, according to the post, which explains how, in the case of a bank, the hacker can see information sent between the victim and bank, modify the information, ask for additional information, lock out the user, or create new requests for unauthorized transactions.

“None of the attacks used separate servers for DNS and web proxy services,” Jackson wrote. “The servers were located on hosting company networks in the UK and in Central or Eastern Europe.”

Page 1 of 2
Share this article:

Sign up to our newsletters

More in News

Carbon Grabber crimeware kit being distributed in spam campaign

A spam campaign involving the Carbon Grabber crimeware kit is ongoing against the automotive industry in Europe, according to Symantec.

Errors in ZeroLocker means paying ransom may not decrypt files

A piece of ransomware known as ZeroLocker contains various errors that may prevent files from being decrypted even if the ransom is paid.

Rogue AV scammers find success with new tatics

Although the number of rogue anti-virus malware campaigns have decreased overall, the threat isn't totally gone, according to researchers at Microsoft.