Researchers at Seqrite, the enterprise arm of IT security firm Quick Heal Technologies, have warned that the attackers have launched a Trojan Malware campaign titled Adwind Java Remote Access Trojan (RAT) Campaign to target Co-Operative Banks in India.  If attackers are successful, they can take over the victim’s device to steal sensitive data like SWIFT logins and customer details and move laterally to launch large scale cyberattacks and financial frauds.

Attackers are sending phishing emails using COVID-19 as a decoy. Those emails claiming to be from the Reserve Bank of India (RBI) or any other Nationalised bank with the title consisting "COVID-19 guidelines or a Financial Transaction" with an attachment zip file containing a JAR based malware. The malware can take over users' devices, steal their information and carry out financial fraud.  The JAR based malware is a Remote Access Trojan that can run on any machine which has Java runtime enabled and hence it can impact a variety of endpoints, irrespective of their base operating system.

Once the Remote Access Trojan (RAT) is installed, the attacker can take over the victim’s device, send commands from a remote machine, and spread laterally in the network. In addition, this malware can also log keystrokes, capture screenshots, download additional payloads, and extract sensitive user information, Seqrite said, adding that such attack campaigns can effectively jeopardize the privacy and security of sensitive data at the co-operative banks and result in large scale attacks and financial frauds.

To prevent such attacks, users need to exercise ample caution and avoid opening attachments and clicking on web links in unsolicited emails.  Banks should also keep their operating systems updated and have a full-fledged security solution installed on all the devices. They need to check the email of the sender properly (whether it is from the official sender who claims to be) before clicking on them.

sponsored links