{"id":18573,"date":"2022-03-23T11:40:07","date_gmt":"2022-03-23T19:40:07","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/03\/23\/news-12306\/"},"modified":"2022-03-23T11:40:07","modified_gmt":"2022-03-23T19:40:07","slug":"news-12306","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/03\/23\/news-12306\/","title":{"rendered":"Bad Actors Trying to Capitalize on Current Events via Shameless Email Scams"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

Many thanks to Fred Gutierrez and Geri Revay for their contributions to this blog.<\/i><\/p>\n

FortiGuard Labs<\/a>\u00a0Research<\/b><\/h2>\n

Affected Platforms:\u00a0<\/b>Windows
Impacted Users:\u00a0<\/b>Windows users
Impact:\u00a0<\/b>Compromised machines are under the control of the threat actor. Stolen personally identifiable information (PII), credential theft, monetary loss, etc.
Severity Level:\u00a0<\/b>Medium<\/p>\n

Malicious email and phishing scams are usually topical and follow a pattern of current events. They are usually crafted around calendar and\/or trending issues as attackers realize that victims are interested in all things relevant to the moment. Threat actors are aware that not all recipients will bite, but some will, hence the origination of the term \u201cphishing.\u201d<\/p>\n

Threat actors often put in the least amount of work possible for a maximum return, sending out phishing emails to thousands of targets. Even if less than one percent of victims respond, the return on investment is still significant due to the gain of personally identifiable information (PII) and\/or establishing a foothold within an organization using stolen credentials, malware, or other means.<\/p>\n

This blog highlights some examples we\u2019ve encountered that may help users better spot suspicious emails. Recent examples observed by FortiGuard Labs include emails related to tax season and the Ukrainian conflict, which reflect the timeliness of current and newsworthy events at the time of writing.<\/p>\n

Tax Season Scams<\/h2>\n

Tax season comes around annually, like other seasonal events or holidays. Targeting calendar-based events enables threat actors to prepare ahead of time and have a new selection of targets on rotation.<\/p>\n

The following set of examples highlights two IRS\/tax-themed scams.\u00a0 The first is a malicious email pretending to originate from the U.S. Internal Revenue Service (IRS) containing a maliciously crafted Microsoft Excel file to deliver malware (Emotet). The second is a phishing scam that asks a recipient to send personally identifiable information (PII) via written correspondence to a phone number.<\/p>\n

IRS-themed email delivering Emotet<\/b><\/h3>\n

This attack starts with an IRS impersonation email that contains a ZIP attachment called \u201cW-9 form.zip\u201d. The email is sent to the target, and a password is provided within the body of the email for convenient extraction. The zipped attachment contains a file, \u201cW-9 form.XLM.\u201d The XLM extension is simply an Excel file that contains Excel 4.0 macros:<\/p>\n<\/p><\/div>\n