Cybersecurity firms Impersonated in Callback Campaigns

What was found?

• The recent campaign is believed to use legitimate RATs for initial access, off-the-shelf penetration testing tools for lateral movement, data extortion, and ransomware deployment.
• At present, the team of researchers cannot confirm the variant used in the campaign. However, the callback operators are believed to be using ransomware for monetization.

How does the callback campaign work?

• In such campaigns, a phishing email is sent to cybersecurity firms conveying that their organization has been breached, and insists into calling a phone number included in the message.
• If the targeted user calls the number, attackers misguide the potential victim to visit a website containing malware, which could be a RAT providing them initial access, perform lateral movement using penetration testing tools, and deploy ransomware. 

Similarities with previous campaigns

• This campaign has made use of similar social engineering tactics to those utilized in other previous callback campaigns such as  Wizard Spider’s 2021 BazarCall campaign.
• Researchers further spotted a similar callback campaign in March 2022. In that campaign, the attackers installed Atera RMM followed by Cobalt Strike for lateral movement and deployed additional malware. 

Conclusion