Researchers at Trellix warn of a spear-phishing campaign that’s targeting CFOs around the world with phony employment offers.
The emails are designed to deliver a legitimate remote access tool that will give the attacker a foothold on the victim’s machine.
“On May 15th, Trellix's email security products alerted on a highly targeted spear-phishing operation aimed at CFOs and finance executives at banks, energy companies, insurers, and investment firms across Europe, Africa, Canada, the Middle East, and South Asia,” the researchers write.
“In what appears to be a multi-stage phishing operation, the attackers aimed to deploy NetBird, a legitimate WireGuard-based remote-access tool on the victim's computer. In recent years, adversaries have increasingly relied on remote-access applications like this to establish persistence and further their way into the victim's network.”
The phishing lures appear to be a job offer from financial services giant Rothschild & Co, and contain a malicious link disguised as a PDF file.
“The attack chain begins with a social-engineered email that pretends to come from a Rothschild & Co recruiter and dangles a ‘strategic opportunity’ with the firm. The attached ‘brochure’ isn't a PDF but a Firebase-hosted page hiding behind a math-quiz custom CAPTCHA. Once the victim solves it, they're handed a ZIP file ( Rothschild_&_Co-6745763.zip ) that unpacks to a VBS script.
Running that script pulls down a second VBS which silently installs two MSI packages: NetBird and OpenSSH, then creates a hidden local-admin account and enables RDP, giving the attacker an encrypted channel for remote access.”
Trellix notes that these attacks are “well-crafted, targeted, subtle, and designed to slip past technology and people.” The researchers offer the following advice to help users avoid falling for the scam:
- Treat unsolicited ‘opportunities’ or cold-recruitment emails with skepticism, especially when they come with a ZIP or obscure download link
- Never bypass security warnings to enable content or scripts from downloads
- Report unusual contact attempts to security teams, even if the email seems harmless. Early reporting is often what prevents compromise
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Trellix has the story.
Here's how it works:
