Crooks always attempt to exploit the attention of the people on the events that made the headlines. In the last days, two events captured the attention of the media, the New Zealand mosque shooting and the tragic crash of the Boeing 737 Max in Ethiopia,
In the wake of the New Zealand mosque shooting, US CISA is recommending users to remain vigilant on possible scams and malware attacks.
Now experts at the 360 Threat Intelligence Center have uncovered a new
Threat actors are using a JAR file as an attachment (i.e. MP4_142019.jar) that acts as a dropper for the Houdini H-WORM RAT, spam emails have subject lines similar to “Fwd: Airlines plane crash Boeing 737 Max 8“.
These emails pretend to be from a private intelligence analyst who found a leaked document on the dark web. This document pretends to contain information about other airline companies will be affected by similar crashes soon.
Below the text used by crooks that was shared by BleepingComputer.
Greetings I believe you have heard about the latest crash Boeing 737 MAX 8 which happen on sunday 10 march 2019, All passengers and crew were killed in the accident Ethiopian Airlines Flight ET302 from Addis Ababa, Ethiopia, to Nairobi, Kenya, crashed shortly after takeoff The dead were of 35 different nationalities, including eight Americans. On 29 October 2018, the Boeing 737 MAX 8 operating the route crashed into the Java Sea 12 minutes after takeoff. All 189 passengers and crew were killed in the accident. note: there was a leak information from Darkweb which listed all the airline companies that will go down soon. kindly notify your love ones about the informations on these file. Regards Joshua Berlinger private inteligent analyst
If a user attempts to open the JAR file, it will be executed by JAVA on the computer. This attachment was originally thought to only install the Houdini H-worm Remote Access Trojan, but security
(SecurityAffairs – Boeing 737 Max, malspam)