Serviceteam IT Security News

Cybercriminals take aim at teleworkers, setting up malicious duplicates of companies’ internal VPN login pages

The United States’ Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) have issued a joint advisory to warn about a surge in voice phishing (vishing) attacks targeting staff at a number of companies.

The spike in phone-based phishing attacks can in part be attributed to the COVID-19 pandemic, which has forced companies to shift to telework and led to a boom in the use of virtual private networks (VPN) and the elimination of in-person verification.

According to the advisory, shared by security journalist Brian Krebs, since around mid-July cybercriminals have been able to steal login details into employee tools at a number of companies. “The actors then used the employee access to conduct further research on victims, and/or to fraudulently obtain funds using varying methods dependent on the platform being accessed,” noted the alert.

As part of the campaigns, the black hats created phishing websites that duplicated or resembled the internal VPN login pages of various companies, obtained Secure Socket Layer (SSL) certificates for their domains and gave them various names that use a combination of the company’s name and hyphen and words such as “support” or “employee”.

RELATED READING: 6 tips for safe and secure remote working

The threat actors also gathered information about their targets. “Actors then compiled dossiers on the employees at the specific companies using mass scraping of public profiles on social media platforms, recruiter and marketing tools, publicly available background check services, and open-source research,” reads the advisory. The amassed information included the targets’ names, home addresses, personal cell/phone numbers, and their job roles.

The attackers then went on to contact their marks, first using Voice over Internet Protocol (VoIP) numbers and later using the spoofed numbers of employees and departments from the victim’s company. Using social engineering techniques, the fraudsters impersonated IT help desk workers and used the information from their dossiers to gain the victims’ trust.

From there, the attackers convinced the targets that they would receive a new VPN link that would require their login, including two-factor authentication (2FA) or a one-time password (OTP). In some cases, the 2FA or OTP prompts were approved by employees mistakenly believing access had been granted earlier to the IT desk impersonator, while in other cases attackers employed SIM swapping attacks to circumvent the security measures.

The agencies also shared advice on how companies could mitigate the risks of such attacks. This includes restricting VPN connections to managed devices, employing domain monitoring, and actively scanning and monitoring web applications for unauthorized access.

Lest we forget: vishing was also at the root of last month’s breach at Twitter, where some 130 high-profile accounts were hijacked to peddle a Bitcoin scam.

Source: HERE

With over 20 years of experience, Serviceteam IT design and deliver sophisticated connectivity, communication, continuity, and cloud services, for organisations that need to stay connected 24/7. We take the time to fully understand your current challenges, and provide a solution that gives you a clear understanding of what you are purchasing and the benefits it will bring you.

To find out how we can help you, call us on 0121 468 0101, use the Contact Us form, or why not drop in and visit us at 49 Frederick Road, Edgbaston, Birmingham, B15 1HN.

We’d love to hear from you!