# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.body
Phishing: One of the easiest ways to be infected with malware, or password theft. This involves a bait email crafted to look like an official one from a legitimate sources. The email often prompts the user to login with confidential information, or to download a "file".

Impersonation: Very similar to phishing but more direct. This is often a phone call where someone is impersonating as an official source. These are very common and often the scam phone calls relating to your car insurance or ssn.

Piggybacking: This is a physical security risk that involves a person tagging along with a legitimate employee and following in quickly behind them.

# data[].attributes.headline
Common ways social engineering affects cybersecurity!

# data[].attributes.subject
Common ways social engineering affects cybersecurity!

# data[].attributes.body
Account information is one of the biggest detriments to social engineering cyber attacks. If a user were to enter their information into a fake email link, then the malicious actors would obtain that information and attempt to steal, delete, blackmail, or sell your private information on any account possible.

Another big concern is downloading dangerous malware. If an employee downloads something they think is legitimate but have actually downloaded something dangerous, the outcome could be very detrimental to the company. Private information and data could again be deleted, sold, blackmailed, or many other malicious uses.

# data[].attributes.headline
Prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.subject
Prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.body
One of the biggest defenses is security training for employees. Having knowledgeable employees that know what to look for in Phishing emails and scam calls is the best first line of defense. Looking at the sender of an email is often a very good tell of whether an email is legitimate or not.

# data[].attributes.headline
$100 Million In Fraudulent Emails (Phishing)

# data[].attributes.subject
$100 Million In Fraudulent Emails (Phishing)

# data[].attributes.attachment_link.readable_text
Geoffrey S. Berman, the United States Attorney for the Southern District of New York, announced that EVALDAS RIMASAUSKAS, a Lithuanian citizen, pled guilty today to wire fraud arising out of his orchestration of a fraudulent business email compromise scheme that induced two U.S.-based Internet companies (the "Victim Companies") to wire a total of over $100 million to bank accounts he controlled. RIMASAUSKAS entered his guilty plea today in Manhattan federal court before U.S. District Judge George B. Daniels.

Manhattan U.S. Attorney Geoffrey S. Berman said: "As Evaldas Rimasauskas admitted today, he devised a blatant scheme to fleece U.S. companies out of $100 million, and then siphoned those funds to bank accounts around the globe. Rimasauskas thought he could hide behind a computer screen halfway across the world while he conducted his fraudulent scheme, but as he has learned, the arms of American justice are long, and he now faces significant time in a U.S. prison."

According to the allegations contained in the Indictment:

From 2013 through 2015, RIMASAUSKAS orchestrated a fraudulent scheme designed to deceive the Victim Companies, including a multinational technology company and a multinational online social media company, into wiring funds to bank accounts controlled by RIMASAUSKAS. Specifically, RIMASAUSKAS registered and incorporated a company in Latvia ("Company-2") that bore the same name as an Asian-based computer hardware manufacturer ("Company-1"), and opened, maintained, and controlled various accounts at banks located in Latvia and Cyprus in the name of Company-2. Thereafter, fraudulent phishing emails were sent to employees and agents of the Victim Companies, which regularly conducted multimillion-dollar transactions with Company-1, directing that money the Victim Companies owed Company-1 for legitimate goods and services be sent to Company-2's bank accounts in Latvia and Cyprus, which were controlled by RIMASAUSKAS. These emails purported to be from employees and agents of Company-1, and were sent from email accounts that were designed to create the false appearance that they were sent by employees and agents of Company-1, but in truth and in fact, were neither sent nor authorized by Company-1. This scheme succeeded in deceiving the Victim Companies into complying with the fraudulent wiring instructions.

After the Victim Companies wired funds intended for Company-1 to Company-2's bank accounts in Latvia and Cyprus, RIMASAUSKAS caused the stolen funds to be quickly wired into different bank accounts in various locations throughout the world, including Latvia, Cyprus, Slovakia, Lithuania, Hungary, and Hong Kong. RIMASAUSKAS also caused forged invoices, contracts, and letters that falsely appeared to have been executed and signed by executives and agents of the Victim Companies, and which bore false corporate stamps embossed with the Victim Companies' names, to be submitted to banks in support of the large volume of funds that were fraudulently transmitted via wire transfer.

Through these false and deceptive representations over the course of the scheme, RIMASAUSKAS caused the Victim Companies to transfer a total of over $100 million in U.S. currency from the Victim Companies' bank accounts to Company-2's bank accounts.

RIMASAUSKAS was arrested by Lithuanian authorities in March 2017, pursuant to a provisional arrest warrant, and was extradited to the Southern District of New York in August 2017.

* * *

RIMASAUSKAS, 50, of Vilnius, Lithuania, pled guilty to one count of wire fraud, which carries a maximum sentence of 30 years in prison. The maximum potential sentences are prescribed by Congress and are provided here for informational purposes only, as any sentencing of the defendants will be determined by the judge.

RIMASAUSKAS is scheduled to be sentenced on July 24, 2019, at 10:00 a.m. before Judge Daniels.

Mr. Berman praised the outstanding investigative work of the Federal Bureau of Investigation, and thanked the Prosecutor General's Office of the Republic of Lithuania, the Lithuanian Criminal Police Bureau, the Vilnius District Prosecutor's Office and the Economic Crime Investigation Board of Vilnius County Police Headquarters, the Prosecutor General's Office of the Republic of Latvia, and the International Assistance Group at the Department of Justice, Canada, for their assistance in the investigation, arrests, and extradition, as well the Department of Justice's Office of International Affairs.

The case is being prosecuted by the Office's Complex Frauds and Cybercrime Unit. Assistant U.S. Attorneys Eun Young Choi and Olga Zverovich are in charge of the prosecution.

# data[].attributes.attachment_link.title
Lithuanian Man Pleads Guilty To Wire Fraud For Theft Of Over $100 Million In Fraudulent Business Email Compromise Scheme

# data[].attributes.attachment_link.description
Geoffrey S. Berman, the United States Attorney for the Southern District of New York, announced that EVALDAS RIMASAUSKAS, a Lithuanian citizen, pled guilty today to wire fraud arising out of his orchestration of a fraudulent business email compromise scheme that induced two U.S.-based Internet companies (the "Victim Companies") to wire a total of over $100 million to bank accounts he controlled.

# data[].attributes.attachment_link.readable_text
A new phishing campaign impersonating the United States Department of Labor asks recipients to submit bids to steal Office 365 credentials.

The phishing campaign has been ongoing for at least a couple of months and utilizes over ten different phishing sites impersonating the government agency.

Spoofed addresses and server abuse

In a new report by email security firm INKY, who shared the report with Bleeping Computer before publication, researchers illustrated how the phishing attack is used to steal credentials.

The emails are sent from spoofed domains that look as if they came from the actual Department of Labor (DoL) site, while some are based on a set of newly created look-alike domains such as:

Most of the emails pass through abused servers owned by non-profit organizations to evade email security blocks.

In other cases, they are sent through newly registered and unreported domains that aren't yet included on anti-phishing lists.

The sender pretends to be a senior DoL employee who invites the recipient to submit their bid for an ongoing government project.

The emails contain a valid letterhead, professionally-arranged content, and a three-page PDF attachment of a seemingly legitimate form.

The PDF contains a "BID" button, which, if clicked, takes the victim to one of the phishing sites. INKY has confirmed the following landing pages as part of this campaign:

opendolbid[.]us

usdol-gov[.]com

bid-dolgov[.]us

us-dolbids[.]us

dol-bids[.]us

openbids-dolgov[.]us

open-biddolgov[.]us

openbids-dolgov[.]com

usdol-gov[.]us

dolbids[.]com

openbid-dolgov[.]us

dol[.]global

The spoofed site looks convincing, containing identical HTML and CSS to the real one. The threat actors have even included an instructions pop-up message to direct victims through the bidding (phishing) process.

Those who bid for a project will be taken to a credential harvesting form that targets their Microsoft Office 365 email address and password.

No matter what's inputted there, the website returns a bogus error to trick the victim into entering them again, thus reducing the chances of stealing mistyped credentials.

If the victim falls for the trap for a second time, they are eventually re-directed to the actual DoL site, left with little evidence as to what exactly has happened.

Similar campaigns on the rise

This campaign's level of sophistication and diligence in setting up convincing web pages and writing error-free phishing emails is worrying.

We saw something similar in December 2021, with phishing actors impersonating Pfizer and using well-crafted PDF attachments to invite recipients to submit bids to the pharmaceutical company.

In this case, the actors take things one step further by abusing legitimate mail servers to send their phishing lures.

Unfortunately, all that leaves email recipients with is very subtle evidence of the trickery targeting them, so ultimate vigilance is advised.

In this case, the most obvious sign of the scam would be the Department of Labor requiring anyone to log in with Office 365 credentials to view a document, something that isn't the case on any U.S. government website.

# data[].attributes.attachment_link.title
Office 365 phishing attack impersonates the US Department of Labor

# data[].attributes.attachment_link.description
A new phishing campaign impersonating the United States Department of Labor asks recipients to submit bids to steal Office 365 credentials. The phishing campaign has been ongoing for at least a couple of months and utilizes over ten different phishing sites impersonating the government agency.

# data[].attributes.headline
CNN Hacker breaking into Company example.

# data[].attributes.subject
CNN Hacker breaking into Company example.

# data[].attributes.attachment_link.title
The Defence Works Sketches   Phishing Emails in Real Life   Funny Security Awareness Training

# data[].attributes.attachment_link.title
Chinese national arrested in Hong Kong over cyber fraud on Austrian aircraft parts maker

# data[].attributes.attachment_link.description
The company, FACC, sacked its chief executive officer after losing €42 million in so-called ‘fake president incident’

# data[].attributes.headline
How easy it is to make a Phishing attack...

# data[].attributes.subject
How easy it is to make a Phishing attack...

# data[].attributes.attachment_link.title
Phishing attacks are SCARY easy to do!! (let me show you!) // FREE Security+ // EP 2