Incidents

Facebook profile: No, it doesn’t work!

We are currently investigating a new malicious campaign on Facebook mostly targeting French speaking users found by our expert researcher Nicolas Brulez. When visiting infected users profiles, one can see the following:

Translation: Wow, it really works! Find out who is viewing your profile!

The links rotates quite fast and leads you to a website which explains to the victims what they need to do. Here is what it looks like:

Basically, there are 2 steps.
• The first one is to copy Javascript code using CTRL+C
• The second one is to visit Facebook.com and to paste the Javascript in your address bar and press the “Enter”key.
In order to make sure their victim is successful, they made an animation file (GIF) describing every step in detail. They want to infect users with limited computer knowledge too. They warn the users that it can take up to 1 minute to process.
Once done, the affected users will spread the campaign on their own walls.
Interestingly, they added a statistic service on the various sites offering the “how to be a victim” page. This page offers quite a lot of interesting information.
For example, here is a graph of the number of visits in the past 24 hours:

We learn that it started to take off around 9pm last night and that it is currently growing fast.
As I am writing this blog, there are currently 2266 visitors on the instruction pages.
Here is a map describing the location of the visitors:

Its obvious France is the center of epidemic right now.
I would like to remind all of you that you can’t see who visited your profile, be it on Facebook or Twitter.
You should avoid all those magical applications or websites like the plague, they don’t work and lead to infection. It’s not new, back in the day, there were fake websites asking for your IM credentials in order to reveal who is blocking you. In fact, you were freely giving criminals your login and password.
IT DOES NOT WORK!!

Facebook profile: No, it doesn’t work!

Your email address will not be published. Required fields are marked *

 

Reports

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Lazarus covets COVID-19-related intelligence

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Sunburst: connecting the dots in the DNS requests

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

What did DeathStalker hide between two ferns?

While tracking DeathStalker’s Powersing-based activities in May 2020, we detected a previously unknown implant that leveraged DNS over HTTPS as a C2 channel, as well as parts of its delivery chain. We named this new malware “PowerPepper”.

Subscribe to our weekly e-mails

The hottest research right in your inbox