The TA4903 hackers impersonate various US government entitiesin BEC attacks and attempt to convince targets to open malicious files with links to fake bidding processes.
Proofpoint analysts spotted the malicious campaign and observed that the hackers were impersonating the US Department of Transportation, the US Department of Agriculture (USDA), and the US Small Business Administration (SBA).
The TA4903 hackers have been active since at least 2019, but began increasing attacks in mid-2023. The latest tactic observed is the use of QR codes in PDF attachments.
See also: What happened with Asimakopoulou and the emails?
The PDF are themed around something related to the entity the hackers are impersonating, but they are all similar. They also all have the same metadata, including an author name that indicates Nigerian origin.
Recipients who scan the QR codes are redirected to phishing websites that resemble official portals from spoofed US government agencies.
Depending on the lure in the phishing messages, recipients may be redirected to O365 login pages, where they are asked to enter credentials .
According to Proofpoint, the TA4903 hackers have purely financial motives and follow the following tactics:
- Gaining unauthorized access to corporate networks or email accounts
- Search within compromised accounts for keywords related to banking information.
- Conducting BEC attacks by sending emails from the compromised account to other employees or partners.
See also: Phishing emails: Warning signs and protection tips
In the initial attacks of 2023, the TA4903 hackers warned of alleged cyberattacks, to trick finance staff into updating payment details.
These messages were delivered from compromised email accounts of the target's affiliated organizations or addresses that closely resembled them.
TA4903 hackers with BEC attacks pose a significant threat to organizations around the world, although most targets are located in the US.
According to Proofpoint, TA4903 hackers register domain names that resemble government entities and private organizations in various sectors. However, recently they have also been imitating small businesses.
See also: Operation Texonto: Russian hackers target Ukrainians with emails about the war
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Hackers TA4903 – BEC attacks: Protection
To protect an organization from BEC attacks, it is necessary to implement a number of strategies. First, employee training is critical. Employees must be aware of the nature of BEC attacks and how to recognize the signs of a potential attack.
Second, implementing email security policies is another important way to protect yourself. This can include using tools that check incoming emails for signs of fraud, such as identifying strange email addresses.
Third, implementing double-checking for important transactions can be very useful. TA4903 hackers request money transfers, but important transactions must be confirmed through independent channels, for example, by email and phone.
Finally, using advanced security IT can help protect against BEC attacks. This can include using software that detects and blocks BEC attacks, as well as implementing policies that restrict access to sensitive information.
Source: www.bleepingcomputer.com
