Tag Archives: ISFB

Fake Xmas Bonus Payslip delivers Ursnif – Gozi

My Online Security Posted on by  

We are still seeing a fairly large Ursnif /Gozi /ISFB campaign hitting the UK again this week.  Today we are seeing an Xmas Payslip theme  The subjects vary slightly but include Wages December, Salary Payslip, Christmas Payslip, Chrithmas Payslip or similar These are coming from dozens ( or even hundreds) of different email addresses and  IP addresses all from 1 hosting company using the IP range of 91.222.237.*  This appears to be a server based in London but controlled by a Russian Entity,  AS202423 PE Viktor Tyurin. All the email addresses pass authentication and the majority of the sending domains have been registered for … Continue reading →

Urgent to all residents of the building email delivers Ursnif

My Online Security Posted on by 1

We are seeing a fairly large Ursnif /Gozi /ISFB campaign hitting the UK since Yesterday. Earlier we saw a Brexit theme and now we are seeing emergency exit notices. The subject this time is consistent in all versions  “Urgent to all residents of the building”. The name in the body of the email matches the alleged sender & is different in each version. These are coming from dozens ( or even hundreds) of different email addresses and  IP addresses all from 1 hosting company using the IP range of 193.233.30.*  This appears to be a server based in Russia, mgnhost.ru AS202423 PE … Continue reading →

Large Ursnif campaign hitting UK using Brexit as lure

My Online Security Posted on by 1

We are seeing a fairly large Ursnif /Gozi /ISFB campaign hitting the UK since Yesterday. The criminals are using the theme of Brexit which is very topical in UK ( and the rest of Europe) at the moment.  There are numerous subjects all with Brexit somewhere in the subject line and there is a link to a google docs page that downloads the malware file. Some subjects I have seen include: Brexit 2019 Brexit 29/03/2019 Brexit 29-03-2019 Brexit | 29-03-2019 Brexit Barometer Brexit   These are coming from dozens ( or even hundreds) of different email addresses and  IP addresses all from 1 hosting company using … Continue reading →

Ursnif campaign hitting UK imitating well known companies

My Online Security Posted on by  

We are seeing an Ursnif /Gozi /ISFB campaign hitting the UK since yesterday. I was first alerted by this Twitter post. I started to investigate quickly last night and several much better researchers and analysts have taken over and found much more details.  I posted some basic details in THIS Tweet.  Then the main analysis appears via THIS.  Whichever bad actor is running this campaign is using extremely good social engineering tricks to imitate multiple well known companies to persuade the recipient to follow  the  links and get infected. Anyway back to this morning and Ursnif /Gozi /ISFB continues to … Continue reading →

Fake Invoice INV-4571 from Platelayers Limited delivers Gozi-Ursnif

My Online Security Posted on by  

An email with the subject of Invoice INV-4571 from Platelayers Limited pretending to come from Platelayers Limited  < messaging-service@subbx.net > with a link to download a  malicious word doc which delivers Gozi/Ursnif/ ISFB banking trojan In other similar malware delivery attempts in the past, the criminals sending these imitated or spoofed dozens if not hundreds of different companies in the emails. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than … Continue reading →

Mailchimp malware continues. Today delivering Ursnif /gozi banking trojan

My Online Security Posted on by  

  After a short break we are seeing Mailchimp abuse & attempted malware spreading again today. The next in the never ending series of compromised or fraudulently set up Mailchimp accounts spreading malware is hitting the UK again today Please read this post explaining the Mailchimp malware saga The first set of emails are generic fake payment messages. The second set pretends to be a HSBC order confirmation Your TX ID PPX001066 coming from  Marissa Smith <suc7=gmail.com@mail52.atl91.mcsv.net>; on behalf of; Marissa Smith <suc7@gmail.com> Your TX ID PPX001066  coming from  Marissa Smith <suc7=gmail.com@mail97.sea61.rsgsv.net>; on behalf of; Marissa Smith <suc7@gmail.com> Document’s 04/04/2018  10:29 AM … Continue reading →

fake “Your Sage subscription invoice is Due” email delivers Gozi /Ursnif / ISFB banking trojan

My Online Security Posted on by  

An email with the subject of Your Sage subscription invoice is Due pretending to come from Sage  but coming from jamie@infographic.pictures  with a link to download a  malicious word doc delivers Gozi /Ursnif / ISFB banking trojan They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Remember many email clients, especially on a mobile phone or tablet,  only show the Name in the From:  and not … Continue reading →

Japanese language fake invoice malspam using macro laden XLS files continue to deliver Ursnif banking Trojans

My Online Security Posted on by  

It looks like the Japanese malspams are still continuing  to deliver Ursnif /Gozi / ISFB banking Trojans. This one is yet another fake invoice email with the subject of 請求書添付書類について  (About invoice attachment documents) , pretending to come from random Japanese email addresses with a malicious Excel XLS  attachment that contains macros They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. As is … Continue reading →

more Japanese language invoice malspam delivering Ursnif

My Online Security Posted on by  

Yet another in the never ending series of Japanese language malspam malware downloaders delivering Ursnif /Gozi / ISFB banking Trojan is this email with the subject of 請求書 (invoice). These emails are coming in slightly malformed and outlook doesn’t want to open them or display them properly. This might be a language encoding issue and Japanese recipients will have no problems opening them. When delivered as a working email, these deliver Ursnif / Gozi / ISFB banking Trojan I can see the content on the mail server, but outlook seems to have difficulty actually displaying the full content. It only shows the … Continue reading →