How are hackers attempting to steal UN worker credentials?

Question

Accepted Answer

Hackers Employ Phishing Schemes Targeting UN Workers for Credential Theft

Hackers are actively targeting United Nations and humanitarian aid workers through sophisticated phishing schemes designed to trick individuals into revealing their passwords. This ongoing campaign, which has been active since early this year, specifically targets relief organizations connected to the UN. The attackers lure unsuspecting workers to counterfeit websites, where their login credentials can be compromised.
Exploitation Through Spoofed Emails and Malicious Websites

The primary method employed in this attack campaign involves the use of spoofed emails, a technique widely known as phishing. These deceptive messages are meticulously crafted to appear legitimate, often mimicking the branding and communication style of trusted organizations. However, embedded within these emails are malicious links or files that, when activated, redirect victims to fake websites designed to mimic authentic login portals. For instance, one lure presented an invitation to take a survey or access online documents, ultimately leading to a fake login page.
Advanced Techniques for Capturing Credentials

The software used by the hackers possesses advanced capabilities to capture typed password information, even if it is rapidly deleted or entered incorrectly. Furthermore, it can recognize and adapt to connections originating from mobile devices, ensuring that stolen credentials are captured regardless of the access method. As described by security researchers, even if a target does not complete the intended login process or mistakenly enters an incorrect password, the captured information is still transmitted to the attacker.
Targeted Organizations and Potential Consequences

Prominent organizations within the UN network, including the UN World Food Program, UNICEF, and the International Federation of the Red Cross and Red Crescent Societies, have been identified as targets. The implications of compromised credentials can be severe, as stolen email passwords can be leveraged to obtain password reset links for other accounts or to impersonate victims, potentially leading to further breaches and misinformation campaigns. One discovered lure even led to a document addressed to the "Pyong Yang international community."
Use of "Bulletproof Hosting" in Malaysia

Evidence suggests that the malicious websites utilized in this phishing attack were hosted by a "bulletproof hosting service" located in Malaysia. These services are designed to offer anonymous computing infrastructure, making it more difficult for investigators or law enforcement agencies to trace the origins of cybercriminal activities. Lookout, the cybersecurity firm that identified the campaign, has alerted the targeted organizations and shared its findings with relevant law enforcement bodies.

Reading history

Hide →

This history is cleared when the page is closed.

How are hackers attempting to steal UN worker credentials?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends