Spam and phishing mail

Malware taxes users

Last month on our Russian blog we talked about how the Zbot Trojan was being spread via spam messages which looked as though they came from the US Federal Tax authorities.

One reader commented jokingly that we should keep tabs on tax deadlines in other countries in order to detect future mass mailings of Zbot.

And then we got an email from HM Revenue and Customs, the body responsible for taxes in the UK:

Of course the link led to a phishing site which looked very like the real HMRC site:

And of course, the exe file which pretends to be a tax statement is Zbot – looks as though this Trojan likes playing taxman!

But it’s not just Zbot – phishers have jumped on the tax bandwagon as well. In the run-up to October 31st, the final deadline for submitting paper self-assessment tax forms in the UK, we’ve seen a number of copies of this email:

You can see how you might be tempted to respond to this message, as it’s offering a tax refund rather than demanding money. But open the attachment, and you end up at a classic phishing site:

Thankfully, the site was quickly denylisted

And the real HMRC includes information about phishing scams on its main page.

Malware taxes users

Your email address will not be published.

 

Reports

APT trends report Q1 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.

Lazarus Trojanized DeFi app for delivering malware

We recently discovered a Trojanized DeFi application that was compiled in November 2021. This application contains a legitimate program called DeFi Wallet that saves and manages a cryptocurrency wallet, but also implants a full-featured backdoor.

MoonBounce: the dark side of UEFI firmware

At the end of 2021, we inspected UEFI firmware that was tampered with to embed a malicious code we dub MoonBounce. In this report we describe how the MoonBounce implant works and how it is connected to APT41.

Subscribe to our weekly e-mails

The hottest research right in your inbox