# data[].attributes.body
What is social engineering?

Deceptive and manipulative techniques to expose information. Most people inherently default to being helpful to avoid conflict. This trait opens them up to exploitation as they may reveal private or sensitive information.

Phishing:

Emails designed to look legitimate that actually contain ransomware. Don't open attachments or emails from people you don't know or companies you aren't in business with.

Pretexting:

Using person to person interactions, usually over the phone, to access sensitive information.

Baiting:

Similar to phishing, but incentivizes clicks with tempting offers and prizes (which are of course fake).

Quid Pro Quo:

Offering a practical service, but instead hacking or installing malware on a target.

Piggybacking:

Following employees into areas of restricted access.

# data[].attributes.body
Stealing $100M!!

https://www.justice.gov/usao-sdny/pr/lithuanian-man-pleads-guilty-wire-fraud-theft-over-100-million-fraudulent-business

# data[].attributes.body
Targeting the Department of Labor

# data[].attributes.attachment_link.readable_text
A new phishing campaign impersonating the United States Department of Labor asks recipients to submit bids to steal Office 365 credentials.

The phishing campaign has been ongoing for at least a couple of months and utilizes over ten different phishing sites impersonating the government agency.

Spoofed addresses and server abuse

In a new report by email security firm INKY, who shared the report with Bleeping Computer before publication, researchers illustrated how the phishing attack is used to steal credentials.

The emails are sent from spoofed domains that look as if they came from the actual Department of Labor (DoL) site, while some are based on a set of newly created look-alike domains such as:

Most of the emails pass through abused servers owned by non-profit organizations to evade email security blocks.

In other cases, they are sent through newly registered and unreported domains that aren't yet included on anti-phishing lists.

The sender pretends to be a senior DoL employee who invites the recipient to submit their bid for an ongoing government project.

The emails contain a valid letterhead, professionally-arranged content, and a three-page PDF attachment of a seemingly legitimate form.

The PDF contains a "BID" button, which, if clicked, takes the victim to one of the phishing sites. INKY has confirmed the following landing pages as part of this campaign:

opendolbid[.]us

usdol-gov[.]com

bid-dolgov[.]us

us-dolbids[.]us

dol-bids[.]us

openbids-dolgov[.]us

open-biddolgov[.]us

openbids-dolgov[.]com

usdol-gov[.]us

dolbids[.]com

openbid-dolgov[.]us

dol[.]global

The spoofed site looks convincing, containing identical HTML and CSS to the real one. The threat actors have even included an instructions pop-up message to direct victims through the bidding (phishing) process.

Those who bid for a project will be taken to a credential harvesting form that targets their Microsoft Office 365 email address and password.

No matter what's inputted there, the website returns a bogus error to trick the victim into entering them again, thus reducing the chances of stealing mistyped credentials.

If the victim falls for the trap for a second time, they are eventually re-directed to the actual DoL site, left with little evidence as to what exactly has happened.

Similar campaigns on the rise

This campaign's level of sophistication and diligence in setting up convincing web pages and writing error-free phishing emails is worrying.

We saw something similar in December 2021, with phishing actors impersonating Pfizer and using well-crafted PDF attachments to invite recipients to submit bids to the pharmaceutical company.

In this case, the actors take things one step further by abusing legitimate mail servers to send their phishing lures.

Unfortunately, all that leaves email recipients with is very subtle evidence of the trickery targeting them, so ultimate vigilance is advised.

In this case, the most obvious sign of the scam would be the Department of Labor requiring anyone to log in with Office 365 credentials to view a document, something that isn't the case on any U.S. government website.

# data[].attributes.attachment_link.title
Office 365 phishing attack impersonates the US Department of Labor

# data[].attributes.attachment_link.description
A new phishing campaign impersonating the United States Department of Labor asks recipients to submit bids to steal Office 365 credentials. The phishing campaign has been ongoing for at least a couple of months and utilizes over ten different phishing sites impersonating the government agency.

# data[].attributes.attachment_link.readable_text
Microsoft on Friday shared more of the tactics, techniques, and procedures (TTPs) adopted by the Russia-based Gamaredon hacking group to facilitate a barrage of cyber espionage attacks aimed at several entities in Ukraine over the past six months.

The attacks are said to have singled out government, military, non-government organizations (NGO), judiciary, law enforcement, and non-profit organizations with the main goal of exfiltrating sensitive information, maintaining access, and leveraging it to move laterally into related organizations.

The Windows maker's Threat Intelligence Center (MSTIC) is tracking the cluster under the moniker ACTINIUM (previously as DEV-0157), sticking to its tradition of identifying nation-state activities by chemical element names.

The Ukrainian government, in November 2021, publicly attributed Gamaredon to the Russian Federal Security Service (FSB) and connected its operations to the FSB Office of Russia in the Republic of Crimea and the city of Sevastopol.

"Since October 2021, ACTINIUM has targeted or compromised accounts at organizations critical to emergency response and ensuring the security of Ukrainian territory, as well as organizations that would be involved in coordinating the distribution of international and humanitarian aid to Ukraine in a crisis," MSTIC researchers said.

It's worth pointing out that the Gamaredon threat group represents a unique set of attacks divorced from last month's cyber offensives that knocked out multiple Ukraine government agencies and corporate entities with destructive data-wiping malware disguised as ransomware.

The attacks primarily leverage spear-phishing emails as an initial access vector, with the messages carrying malware-laced macro attachments that employ remote templates containing malicious code when the recipients open the rigged documents.

In an interesting tactic, the operators also embed a tracking pixel-like "web bug" within the body of the phishing message to monitor if a message has been opened, following which, the infection chain triggers a multi-stage process that culminates in the deployment of several binaries, including -

PowerPunch - A PowerShell-based dropper and downloader used to retrieve the next-stage executables remotely

Pterodo - A constantly evolving feature-rich backdoor that also sports a range of capabilities intended to make analysis more difficult, and

QuietSieve - A heavily-obfuscated .NET binary specifically geared towards data exfiltration and reconnaissance on the target host

"While the QuietSieve malware family is primarily geared towards the exfiltration of data from the compromised host, it can also receive and execute a remote payload from the operator," the researchers explained, while also calling out its ability to take screenshots of the compromised host about every five minutes.

This is far from the only intrusion staged by the threat actor, which also struck an unnamed Western government organization in Ukraine last month via a malware-laced resume for an active job listing with the entity posted on a local job portal. It also targeted the country's State Migration Service (SMS) in December 2021.

The findings also arrive as Cisco Talos, in its continuing analysis of the January incidents, disclosed details of an ongoing disinformation campaign attempting to attribute the defacement and wiper attacks to Ukrainian groups that date back at least nine months.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

# data[].attributes.attachment_link.title
Microsoft Uncovers New Details of Russian Hacking Campaign Targeting Ukraine

# data[].attributes.attachment_link.description
Microsoft shared more details on tactics and techniques that Russia-based Gamaredon hacking group used to facilitate cyberespionage attacks.

# data[].attributes.attachment_link.title
Social Engineering Attacks and How To Recognize Them

# data[].attributes.attachment_link.title
Social engineering Techniques |Types of Social Engineering threats | Social Engineering Hacking

# data[].attributes.attachment_link.title
Social engineering: How phishing works and why criminals make more money with email than ransomware

# data[].attributes.headline
What are some of the most common ways social engineering affects cybersecurity?

# data[].attributes.subject
What are some of the most common ways social engineering affects cybersecurity?

# data[].attributes.body
Social engineering affects cybersecurity by introducing new exploitable gaps in an organizations cyber defenses...namely, people. Through pretexting, phishing, and other methods, hackers are able to bypass the most technically proficient security measures and gain access simply by getting someone to answer the phone or open an email.

# data[].attributes.headline
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.subject
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.body
The best thing we can do to prevent attackers from leveraging social engineering attacks is to provide education and training about the methods employed. Training "phishing" emails to increase individual vigilance, examples of phone calls, and other annual training requirements are a great start. Additionally, limiting access for those on the front lines, and segregating the data so no one person has access to the entire system provides an excellent moat against these types of attacks.

# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.body
Typically, there is at least some effort, oftentimes much effort, to gather information about the target from publicly available sources like LinkedIn, Facebook, etc. Then, based on the information gathered, and probably with multiple targets in mind, the hackers will employ a variety of techniques to see what sticks. If pretexting, then they will target empathetic or sympathetic responses. If phishing, they will try to incentivize clicks and make them look legitimate. It's target dependent, and we can expect that multiple efforts will be made using a variety of methods, not just one.