Skip to main content

Bad "landing": hackers target airlines

Top global airline companies have been compromised by fraudsters for the second time during the last six months.

This time, criminals used the tried and tested "gift" scheme for promotion on Facebook: "Lufthansa is giving away 2 tickets!" These posts are actively shared by colleagues, friends and acquaintances – and under the influence of the freebie strategy and their friends, a person goes on a website with an airline company's logo. Fraudsters deliberately create addresses using names of famous brands in order to put people off their guard. This technique is called spoofing.

To get the free air tickets, a user is prompted to answer a few simple questions: "Have you ever traveled with our company?", "Do you really want to get 2 free tickets?", and "Confirm that you are an adult". After that, the message "Lufthansa is giving away 2 tickets!" and a photo of two boarding passes with the airline's logo are displayed. To get them, a user needs to like the webpage and share the post among their friends in their account. That is how you may unknowingly involve your friends in the fraudulent scheme.

Of course, there are no free air tickets. The best of the 'worst' case scenarios is that a user is redirected to an advertising page and fraudsters receive money for increased traffic. Now, this viral campaign has started in Europe – the first posts have been shared by Facebook users abroad. On September 26, Lufthansa notified users about the fake campaign on its official Facebook page and urged passengers to resist provocations and think about their security!

Lufthansa is not the only company that has faced such troubles. Specialists of the Group-IB CERT (Computer Emergency Response Team) revealed that at least 86 domains had been registered in the name of a certain Rachita M. since August 31 and that those domains used international airline companies' names: Air Canada, Swissair, British Airways, Air-France, Austrian Airlines, and others. Fraudsters made photos of the companies' official board passes for each fake campaign, and the questionnaire was prepared in the airlines' national languages.

A similar large-scale fake campaign was tracked this June. Specialists of Group-IB's Investigation Division found out that fraudsters used airlines' brands to increase traffic on the websites of clients of an American company providing website and mobile app promotion and monetization services. In some cases, users were asked to provide their personal information: name, email, phone, date of birth, and address, or were signed up for paid services.

This time, the ultimate goal of the campaign is unclear – users are not forwarded anywhere. Some of the detected phishing websites with questions do not open – it may be the case that fraudsters are just preparing for a large-scale campaign.

The danger here is that this scheme can be used by hackers for cyberattacks. Special people – traffers – redirect users from popular websites to malicious ones where money stealing Trojans are downloaded. Your computer may be connected to a botnet to conduct DDoS attacks or used to mine bitcoins.


Popular posts from this blog

NanoCore developper busted and senteced for 33 months

A hacker who was arrested and pleaded guilty last year—not because he hacked someone, but for creating and selling a remote access trojan that helped cyber criminals—has finally been sentenced to serve almost three years in prison.

Taylor Huddleston, 26, of Hot Springs, Arkansas, pleaded guilty in July 2017 to one charge of aiding and abetting computer intrusions by building and intentionally selling a remote access trojan (RAT), called NanoCore, to hackers for $25.

Huddleston was arrested in March, almost two months before the FBI raided his house in Hot Springs, Arkansas and left with his computers after 90 minutes, only to return eight weeks later with handcuffs.
This case is a rare example of the US Department of Justice (DOJ) charging someone not for actively using malware to hack victims' computers, but for developing and selling it to other cybercriminals.
Huddleston admitted to the court that he created his software knowing it would be used by other cybercrimina…

ICEMAN : Infecting Crystal Finance Millennium

Iceman gang member confirms that they are behind the introduction and spreading of malwares that have affected Crystal Finance Millennium, a Ukraine-based accounting software firm. Was this a political based attack? Read more to find out.
I’ve had a chance to speak to one of the gang member on XMMP and he confirmed that the Iceman group is behind this attack. They started by a simple web attack (SQLI which lead to web shell upload, no privilege escalation was needed) in order to gain access to the web servers of the company. He confirmed that the math was simple, the Ukrainian company had many clients in the financial and medical sector which facilitated the propagation of their malware. From the archived web page, it becomes apparent they provide accounting software, personalization of medical records, blood service and "full automation of the doctor's office" - contrary to what their company name suggests, it appears they are (mostly) focused on medical software.

KillaMuvz: Undercovered british hacker

The Briton Goncalo Esteves (24), also known as KillaMuvz, has pleaded guilty to charges related to creating and running malware services. The Briton Goncalo Esteves (24) has pleaded guilty to charges related to creating and running malware services.
Such kind of platforms allows crooks to improve the development of their malicious codes. The malware created with the Esteves’ malware services would not be detected by antivirus software.
Esteves that was used the moniker ‘KillaMuvz’ is the creator of Cryptex tool commonly used by vxers to encrypt their files in an effort to avoid the detection. The first version of Cryptex was released in October 2011 and was continuously improved.
According to the NCA, Esteves has pleaded guilty to two computer misuse charges and one count of money laundering, the sentence is planned for February 12. “A cyber criminal has admitted running a product-testing service for hackers following a joint investigation by the National Crime Agency (NCA) a…