New Malware Attack Tries To Trick People By Pretending To Be EFF
from the who-are-they-targeting? dept
The Electronic Frontier Foundation has put out an alert noting that, as part of a larger spear phishing attack campaign, to try to gain control over computers, a group has created a fake EFF website, designed to trick people into thinking they're going to EFF's actual website, but really installing some pretty nasty malware.Needless to say, don't visit the site unless you know what you're doing -- and also, a good reminder not to click on URLs in emails. Go directly to sites.Electronicfrontierfoundation.org was not the only domain involved in this attack. It seems to be part of a larger campaign, known as “Pawn Storm”. The current phase of the Pawn Storm attack campaign started a little over a month ago, and the overall campaign was first identified in an October 2014 report from Trend Micro (PDF). The group behind the attacks is possibly associated with the Russian government and has been active since at least 2007.
The attack is relatively sophisticated—it uses a recently discovered Java exploit, the first known Java 0-day in two years. The attacker sends the target a spear phishing email containing a link to a unique URL on the malicious domain (in this case electronicfrontierfoundation.org). When visited, the URL will redirect the user to another unique URL in the form of
http://electronicfrontierfoundation.org/url/{6_random_digits}/Go.classcontaining a Java applet which exploits a vulnerable version of Java. Once the URL is used and the Java payload is received, the URL is disabled and will no longer deliver malware (presumably to make life harder for malware analysts). The attacker, now able to run any code on the users machine due to the Java exploit, downloads a second payload, which is a binary program to be executed on the target's computer.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: malware, pawn storm, spear phishing
Companies: eff
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re:
Hello, Sheogorath. In the absence of anything else to do about it, I've hit Report. I suggest you and everyone else do the same.
Dear Techdirt, this page is now permanently serving Russian government malware, until you manually remove or alter the link. Well done.
As a strategy for dealing with this kind of issue in the longer term, I suggest you learn to FUCKING EDIT BUTTON, already. >:/
[ link to this | view in chronology ]
Re: Re:
My sympathies xD
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re: Re:
I don't see it as a link, but that is probably because I have disabled most of the javascript served up by Techdirt (unless Mike has already removed the tags.)
Then again, I occasionally submit comments with tags where it strips one or more of the tags (or, far more likely, I break it somehow,) leaving my comment with an unlinked link, but figure that if folks really want to follow it, they can copy and paste.
[ link to this | view in chronology ]
Re: Re: Re:
It's been fixed since.
[...] (unless Mike has already removed the tags.)
There weren't any tags in the first place. I used tags on the official EFF website link, yes, but not on the fake EFF website link above it because it was my intention not to link to the fake site at all.
[ link to this | view in chronology ]
Re: Re: Re: Re:
Cool.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re:
[ link to this | view in chronology ]
Re:
/s
[ link to this | view in chronology ]
Good reminder, but I have a better one
[ link to this | view in chronology ]