Pierluigi Paganini
March 20, 2016
A new malware-based campaign is targeting key employees from companies in the US, Middle East and Asia. The attackers are using malware in a classic business email compromise (BEC) attack in order to hijacking the email accounts of the victims and authorize financial transactions on their behalf.
The attacks have been traced back to Lagos and Kuala Lumpur.
“The Business Email Compromise (BEC) is a sophisticated scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. Formerly known as the Man-in-the-E-mail Scam, the BEC was renamed to focus on the “business angle” of this scam and to avoid confusion with another unrelated scam.” reports the statement issued in 2015 by Internet Crime Complaint Center (IC3) and the FBI.
In this last wave of attacks uncovered by experts at antivirus firm Trend Micro that hackers attempted to gain control of victims’ accounts to trick other employees, suppliers or business partners to perform wire transfer payments to accounts controlled by the crooks.
The cyber criminals targeted key employees at companies from 18 countries by spreading a commercial keylogger named Olympic Vision. The attackers sent to the victims malicious emails masqueraded as messages from business partners which pretend to provide information related to alleged problems occurred with a recent bank transfer of invoice.
“Olympic Vision is a keylogger malware involved in an ongoing Business Email Compromise (BEC) campaign targeting 18 companies in the US, Middle East and Asia, the majority of which coming from the two latter regions (22%, 39% and 39% respectively). Business Email Compromise attacks involve spear phishing/social engineering techniques to infect key employees’ systems with info-stealing malware and intrude upon business dealings/transactions. ” states a report published by Trend Micro.
The researchers explained that the Olympic Vision keylogger is very cheap, it is available on the black market for $25, but the experts highlight that it isn’t a very advanced threat.
“Olympic Vision is the fourth malware we’ve seen used in Business Email Compromise campaigns, after Predator Pain, Limitless, and HawkEye. Similar to other BEC malware, Olympic Vision is capable of stealing a variety of information from its target, and comes with a small price tag – its toolkit can be bought for $25. ” Trend Micro wrote in a blog post.
“Olympic Vision is not advanced by any means. Like Predator Pain and Limitless, keyloggers that have been used for the very same purpose in previous BEC campaigns, it performs its main function – that is, to log keystrokes and take screenshots for the purpose of stealing personal information – well and without unneeded complexity.” continues the report.
Once installed on the victim’s machine, Olympic Vision collects information about the system configuration, login credentials saved in several applications (i.e. Email clients, browsers, FTP programs and instant messaging applications) and key strokes. The malware also gathers network information and images and text in the clipboard.
Despite the threat is not particularly advanced, it is perfect to collect information that is used by attacker to understand the accounting workflows of the targeted firms.
“We looked at the trail of Olympic Vision keyloggers being used in the wild to check for organized activity, and were able to trace the identities of the actors, and positively identified two Nigerian cybercriminals — one operating from Lagos, and the other from Kuala Lumpur,” continues the blog post.
Business Email Compromise is a serious threat to businesses that causes losses for thousand million dollars every year.
[adrotate banner=”9″]
(Security Affairs – Business Email Compromise, keylogger)
