Residents of Volgograd region told about new schemes of targeted cyber attacks

Seeming plausibility

Attackers use real names of organizations, names, positions, contacts and current agenda, mask malicious files as working documents, and protect archives with passwords. Behind the plausible legend may be the beginning of a multi-stage attack – launching a file can lead to downloading malicious components or obtaining remote access to the device.

Legend #1: Urgent coordination

In one scenario, attackers simulate business correspondence on the project. The recipient is asked to speed up the coordination of the technical specification with the management - a delay allegedly can affect the timing of work. The letter was signed by the “chief engineer of production”, the text indicates that the message was allegedly checked by antivirus. A password-protected archive is attached to it, inside which the malicious file is disguised as a working document. After launch, attackers are able to remotely connect to the compromised device.

Legend 2: Requirements to Strengthen Cybersecurity

Another trick is a report allegedly from the agency about new requirements for strengthening cyber defense measures. The recipient is asked to urgently read the “service note” in the attachment. Inside the archive, malware is hidden instead of the expected document. When it is launched, passwords and other data stored on the device are threatened. The official style, authoritative sender and the requirement to act immediately are designed to add a letter of credibility, and the topic of information security becomes bait.

Legend #3: Visiting foreigners

Here's an unusual legend. The letters state that a foreign delegation is supposedly planning a working visit to a Russian enterprise to get acquainted with production technologies, meet with specialists and exchange experience. For persuasiveness, the post of the intended sender and contacts of a technical specialist are indicated in the message. An archive with a malicious file is attached to the letter. When it is launched, attackers will be able to collect information about the user’s actions on the device. If an employee opens an attachment from a letter that looks official, it could compromise sensitive data.

How to protect yourself

In targeted attacks, attackers try to make emails as similar as possible to the usual working communication, and sometimes add additional elements of trust - for example, a note that the letter is allegedly checked by an antivirus.

“However, it is important to pay attention to the context: whether you expected such a letter or document, whether it is really related to your work tasks,” Anna Lazaricheva, senior spam analyst at Kaspersky Lab, warns. Particularly attentive to unexpected requests related to financial transactions, credentials, installation of any programs. We recommend that you do not open unexpected attachments or click on links.”.

The expert advises: in case of the slightest doubt, it is better to contact the sender via another, already known communication channel, for example, call the saved phone number or write to the email address you used to communicate with him before.