Nigerian Threat Actors Solicit Victim Organization Employees to Deploy Demon Ransomware
The use of employees as insider accomplices potentially changes how social engineering is being used in exchange for a direct request for internal assistance.
Security researchers at Abnormal Security have identified a recent set of emails soliciting employees of a would-be victim organization to participate in helping the threat actors by installing DemonWare/Black Kingdom ransomware within the organization.
The emails are simple in nature and contain no malicious links or attachments – something the threat actors hope will allow their request to get past security solutions.
Source: Abnormal Security
The researchers at Abnormal Security decided to engage the threat actors to better understand how the infection would take place. A link to an executable file was provided via file sharing sites WeTransfer or Mega.nz. It’s also interesting to note that the $1M purse offered in the initial email was dropped down (during Abnormal Security engaging of the threat actor) to an offer of only $120K.
What’s most interesting is that Abnormal Security was able to get the threat actor to tell them his source of contacts: CEO and CFO emails from LinkedIn. So, even this lone threat actor is doing proper diligence using whatever means they can to target individuals within an organization.
While it’s evident this type of attack doesn’t fall within the realm of phishing, it could have gone awry in more ways than one. In this specific instance, the attacker legitimately wanted the insider to do all the work. But it’s also conceivable that social engineering could have been used to compromise credentials along the way. So it’s still important to include Security Awareness Training of even your highest C-level executives to ensure they don’t fall prey to scams.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 21 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW