Researchers are warning of a new spear phishing campaign in which users are being targeted by emails crafted to look like terror alerts from law enforcement agencies.
Symantec threat intelligence officer, Lionel Payet, wrote in a
blog post that the emails were first spotted spoofing the Dubai Police Force with attachments disguised as valuable tips on how recipients could protect themselves, their companies and families from a nearby terror attack.
It continued:
“The emails come with two attachments, one of which is a PDF file that is not actually malicious but acts as a decoy file. The malware resides in the other attachment, an archive, as a .jar file. Further analysis of the malware confirms that the cyber-criminals behind this campaign are using a multiplatform remote access Trojan (RAT) called Jsocket (detected as Backdoor.Sockrat). This RAT is a new product from the creators of the AlienSpy RAT, which has been discontinued earlier this year.”
To make the email look more convincing it is ‘signed’ with the name of the lieutenant general of the Dubai police, who is also responsible for security in the emirate.
