Hello Security

The Hello Security team has recently witnessed a large spike in nefarious scammer activity surrounding around the Facebook platform.

the phishing attacks currently targeting the United States include, Nefarious URLs posted on facebook beneath a " Rent to own" or "Lucrative job offer" facebook posting, and are followed up with Spyware and malware intent to harvest user credentials, PII, and banking information.

This scam campaign resembles a large net being cast with no real individual target, rather, relying on such a vast amount of malicious facebook posts, and such a wide berth of groups shared within.

Hello Security Researchers have spotted this activity in multiple states across the U.S., from Wisconsin to Colorado.

These current attacks seem to be stemming geographically, from India and Africa.

Hello Security Team advises not to click any link found in the comment section of a listing that sounds to good to be true. Use a VPN to provide a layer of anonymity in the event you do accidently click one of these links. if possible, sandbox your devices and limit the amount of lateral movement that can be had if an attacker gains access to any device or account.

Hello Security takes a look at the Malibot malware.

www.hellosec.org

Ransomware attacks are still lucrative for cyber threat actors because victims still pay ransoms – and the threat is still evolving.

Major ransomware attacks like those on Colonial Pipeline, the Irish Healthcare Executive and many others demonstrated how significant the problem had become as cyberattacks disrupted people's lives, organizations and their security, and cost a fortune in remediation.

What was once a small cyber-criminal industry based around encrypting files on personal computers and demanding a ransom of a few hundred dollars for a decryption key had evolved into a massive ecosystem designed around holding critical services and infrastructure for ransom – and making extortion demands of millions of dollars.

Lindy Cameron, head of the UK's National Cyber Security Centre (NCSC), has described ransomware as "the biggest global cyber threat"

Ransomware is continually evolving, with new variants appearing, new ransomware groups emerging, and new techniques and tactics designed to make the most money from attacks.

While ransomware attacks against large organisations get noticed, a ransomware attack against a small or local business, where the victim quickly pays the ransom because they feel as if they've got no other choice, might not get reported at all, and is far more common.

Individual attacks against smaller targets won't bring a huge payday like a successful attack on a big corporation would, but by chaining together a series of attacks against a range of smaller victims, ransomware attackers can still turn a substantial profit.

Ransomware is loud – some criminals may turn to quieter alternatives.
Groups of threat actors could still be laying the foundation for a new wave of ransomware attacks – and yet some hacking groups are likely to be turning their attention towards other cyberattacks that are less noisy but nonetheless profitable for the attacker and detrimental for the victim.

We're going to see that initial access leveraged at scale, so it may be ransomware final-stage payloads, maybe something else – we are seeing a big return to banking trojans in the current Enterpriseand SMB industry markets.

Trojan malware allows threat actors to steal sensitive information from victims, including bank account details, providing them with the opportunity to steal money directly from their victims.