Incidents

Nigerian Polyglots

Messages from bank workers or millionaires looking for someone to help them cash in huge sums of money are no longer capable of surprising us. Most of these emails are written in English, which has long been the language of international correspondence – it was unusual to ever see these kinds of messages written in other languages.  However, that has changed, and now we are increasingly seeing letters like this written in Portuguese, French, Spanish and Russian as well as in Hebrew, Belorussian and Arabic.

Here is a letter about a win in an “Australian Lottery” held across several continents. It is written in Arabic and uses a standard scam: the recipient is told that he/she was randomly selected from among millions of people and has won a large sum of money. In order to claim the money, the user has to contact the scammers.

In the next letter, written in Hebrew, a bank clerk offers to share a multi-million fortune that belonged to a client of the bank who died in an accident.

The following letter is written in Belorussian and again tells of a millionaire who has died. The bank is searching for his relatives so they can pass on an inheritance.

The scammers often use electronic translation tools to translate their messages into other languages. As a result, their messages can be distorted during translation. Also, the scammers don’t pay much attention to the regional characteristics of the potential recipient – using the same stories about millionaires dying without leaving an heir, and merely translating the texts into the appropriate language. If you receive a message like this in your native language and find certain things about it odd, it’s better to just laugh at their attempts to be polyglots, and ignore all their promises of wealth. After all, regardless of the sums mentioned or the language used, these scams remain just that – scams.

Nigerian Polyglots

Your email address will not be published. Required fields are marked *

 

Reports

Lazarus targets defense industry with ThreatNeedle

In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Lazarus covets COVID-19-related intelligence

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Sunburst: connecting the dots in the DNS requests

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

Subscribe to our weekly e-mails

The hottest research right in your inbox