Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Phishing

10/26/2018
09:35 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now
50%
50%

Multiple Phishing Attacks Target Top Universities

Kaspersky Labs sent out a warning this week that multiple phishing campaigns have targeted more than 100 universities and schools over the past year, including the University of Washington, Cornell University and others.

Over the past year, multiple phishing campaigns have targeted major universities and schools in over 100 different countries, including several US-based institutions, with threat actors looking to steal research and other intellectual property or to gather more credentials for future attacks.

The schools targeted by these phishing attacks include the University of Washington, Cornell University, Harvard Business School, Stanford University and the University of Iowa. All told, 131 universities in 16 countries were subject to these malicious campaigns.

For the last 12 months, Kaspersky Lab has been tracking these attacks, and warning schools and universities about ongoing phishing campaigns. The company published its findings in a October 24 blog post, and noted that none of the schools sustained a data breach but that these incidents are continuing.

In an email to Security Now, Nadezhda Demidova, security researcher at Kaspersky Lab and the author of the report, wrote that while these various phishing campaigns could be the work of the same group, researchers do not have proof that these attacks are coordinated.

However, what Kaspersky found was that these attacks are designed to steal research, as well as credentials and other data, such as the IP address of the victim's device.

"Our assumption is that the main goal of these attacks was to gain access to research," Demidova wrote. "However, scammers are interested in any personal information, as they can sell it or use in the future to create spear-phishing attacks aimed at a specific person or organization."

In its blog post, Kaspersky research describes similar techniques used in these different campaigns. In most cases, the attackers created a fake webpage that was made to look like the university's official site or an intranet portal associated with the school. These pages contained a few letters that were different from the official URL.

The sites were spread to students and staff through various social engineering techniques and any data or credentials entered into these phony site were sent to the attackers, Demidova added:

Phishing attacks have long spread not only through email, but through any available means. Since attacks are recorded regularly around the world, the methods of distribution can be completely different. The main purpose of the scammers in this case is to lure the victim to a fake website and encourage them to enter their account login data.

Overall, Kaspersky detected nearly 1,000 phishing attacks in 12 months, with 83 different campaigns targeting US-based schools and another 21 aimed at UK universities. Attacks were also recorded in Finland, Colombia, Hong Kong, India, Israel, the Netherlands, New Zealand, Poland, South Africa, Sweden, Switzerland and the UAE.

The University of Washington seemed a particularly popular target. That school accounted for over 11% of all attacks.

While phishing is one of the oldest problems in cybersecurity, these attacks have increased in scale and sophistication as of late, with Barracuda Networks and Palo Alto Network's Unit 42 describing a surge in phishing over the past year. (See Phishing Attacks Are Increasing & Gaining in Sophistication.)

In more traditional enterprises, security teams have seen an increase in Business Email Compromise (BEC) and Email Account Compromise (EAC) attacks, which use a combination of cheap hacking tools and phishing techniques to steal the credentials of company executives. (See Attackers Can Compromise Corporate Email Accounts for $150.)

For schools and universities, Kaspersky is offering some practical advice to counter these phishing attacks, including:

  • Always check the link address and the sender's email to determine if they are genuine before clicking. If you receive a link through email that appears suspicious, type it into the browser's address line instead of clicking through the email.
  • If you are not sure that a website is real and safe, never enter your credentials. If you think that you may have entered your login and password on a fake page, change your password immediately.
  • Avoid using the same password for several websites or services, as it puts all of your accounts at risk if your login to one site becomes compromised.

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cloud Security Threats for 2021
Or Azarzar, CTO & Co-Founder of Lightspin,  12/3/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27772
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could po...
CVE-2020-27773
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to appli...
CVE-2020-28950
PUBLISHED: 2020-12-04
The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.
CVE-2020-27774
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but co...
CVE-2020-27775
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but c...