Cybercriminals are impersonating cybersecurity companies to try and lure victims into downloading compromising programs.
An investigation by Crowdstrike, one of the cybersecurity companies impersonated (opens in new tab) in the campaign, uncovered a “callback phishing” campaign in which threat actors are reaching out to various companies via email, telling them their endpoints are compromised, and urging them to call the company back for further instructions on how to eliminate the threat.
The email also carries the phone number that the victims should call, and as you might imagine, it doesn’t belong to the actual company, but rather to the attackers.
Legitimate software and nefarious goals
If the victim falls for the scam and actually calls the number in the email address, the person on the other end of the line will try and persuade them into downloading “common legitimate remote administration tool (RATs),” which would give them access to the target network. Furthermore, they’d try and get the victim to install off-the-shelf penetration testing tools, such as Cobalt Strike, to allow for lateral movement.
Following the successful breach and lateral movement, the attackers will look to deploy ransomware, although Crowdstrike could not say exactly which ransomware variant they use.
One of the reasons why such a campaign could be relatively successful is the fact that the emails carry no links, or attachments. As such, it is possible for email security (opens in new tab) solutions, as well as antivirus programs, not to detect these emails as malicious, and release them to the target’s inbox.
What’s more, giving cyberattackers your phone number also opens up an additional avenue for attacks.
It’s not exactly a new strategy. Cybercriminals have been using this approach for months now, as email security systems grew more sophisticated and better at spotting malicious actors.
Around Black Friday 2021, scammers were also found to be impersonating big brands such as Amazon, Target, and Walmart, attempting to get victims to call them.