Tibet phishers hit back at AlienVault

Powered by SC Magazine
 

Phishing emails impersonate security researchers.

Phishing scammers have impersonated AlienVault researchers in fake emails sent to Tibetan organisations.

The initial detection by Alienvault of spearphishing attacks from China was announced two weeks ago. Those attacks saw emails sent with malicious PDFs that contained a variant of Gh0st RAT (a remote-access trojan),  exploiting a known Microsoft vulnerability.

But the attack was a "case of imitation being the sincerest form of flattery", according to AlienVault's chief researcher Jamie Blasco.

“The fact that the pro-Chinese sympathisers have taken our research seriously enough to start trying to blacken our name indicates that our message about the Chinese cyber attackers has hit home, and the cyber criminal activists are not happy," he said.

The emails were sent from ‘admin@alienvault.com' with a subject line of "Targeted attacks against Tibet organisations" and contain a malicious payload that loads a Java applet, which exploits CVE-2011-3544.

“Our research suggests that the attacks we have been tracking over the past month are linked to the Kalachakra Initiation, a Tibetan religious festival that took place in early January. The spearphishing emails are quite sophisticated and feature an attachment that exploits a stack overflow vulnerability dating back to last September.

“Yes, AlienVault has effectively been drawn into the cyber conflict itself, but we plan on continuing to report on this humanitarian cause for as long as it takes. Our email spoofing problems are nothing compared with the problems that Tibetans are facing.”

Blasco also said that automated bots were used to spam Twitter users with hashtags including #tibet and #freetibet. He said the junk tweets were from automated Twitter accounts controlled by the Chinese Government or its sympathisers.

Copyright © SC Magazine, UK edition


Tibet phishers hit back at AlienVault
 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1793

Vote
Do you support the abolition of the Office of the Information Commissioner?