SpamScams.net
  • Spam Emails
    • Affiliate Spam
    • Email Spam News
    • iPhone Spam
    • Link Building Spam
    • Link Exchange Spam
    • Pharmacy Spam
    • SEO Spam
    • Spam Email
    • Spam Email Alerts
    • Web Design Spam
  • Stop Spam Tips
  • Fraud Alerts
  • Fraud Protection Tips
  • Identity Theft Scams
Select Page

Spear Phishing Emails Target U.S. Law and PR Firms

by SpamHater | Nov 18, 2009 | Spam Email Alerts

Spear Phishing Emails Target U.S. Law Firm and Public Relations Firms

The FBI assesses with high confidence that hackers are using spear phishing e-mails with malicious payloads to exploit U.S. law firms and public relations firms.

During the course of ongoing investigations, the FBI identified noticeable increases in computer exploitation attempts against these entities. The specific intrusion vector used against the firms is a spear phishing or targeted socially engineered e-mail designed to compromise a network by bypassing technological network defenses and exploiting the person at the keyboard. Hackers exploit the ability of end users to launch the malicious payloads from within the network by attaching a file to the message or including a link to the domain housing the file and enticing users to click the attachment or link. Network defense against these attacks is difficult as the subject lines are spoofed, or crafted, in such a way to uniquely engage recipients with content appropriate to their specific business interests. In addition to appearing to originate from a trusted source based on the relevance of the subject line, the attachment name and message body are also crafted to associate with the same specific business interests. Opening a message will not directly compromise the system or network because the malicious payload lies in the attachment or linked domain. Infection occurs once someone opens the attachment or clicks the link, which launches a self-executing file and, through a variety of malicious processes, attempts to download another file.

Indicators are unreliable to flag in-bound messages; however, indicators are available to determine an existing compromise. Once executed, the malicious payload will attempt to download and execute the file ‘srhost.exe’ from the domain ‘http://d.ueopen.com’; e.g. http://d.ueopen.com/srhost.exe. Any traffic associated with ‘ueopen.com’ should be considered as an indication of an existing network compromise and addressed appropriately.

The malicious file does not necessarily appear as an ‘exe’ file in each incident. On occasion, the self-executing file has appeared as other file types, e.g., ‘.zip’, ‘.jpeg’, etc.

Please contact your local field office if you experience this network activity and direct incident response notifications to DHS and U.S. CERT.

For more information, see FBI E-Scams & Warnings

Web Hosting

Why We’re Here

SpamScams is the Ultimate Spam Email Archive. Shedding light on email spam, scams, identity theft, and phishing schemes.

The purpose of SpamScams.net is to inform, not promote spam. Please DO NOT believe the spam email you receive. Even more importantly, DO NOT reply to them, DO NOT contact them, and DO NOT click on any links which we may have missed deleting. Furthermore, the inclusion of a company name(s) in spam emails DOES NOT automatically infer wrongful doings on the part of the named company, only that a scammer may be using the name of a legitimate company in order to complete their ruse.

Spam Email Topics

2020 Election Bank Draft Bank of America Beneficiary CAN-SPAM Central Bank China Citibank Compensation Contact Form Covid-19 DHL Email Scam FBI Fraud Fraud Protection Google IC3 India Inheritance Internet Crime Complaint Center IRS Link Building Lottery Malware MoneyGram Nigeria Paraguay PayPal Phishing Ransomeware Republic of Benin Scam Search Engine Optimization SEO Spam Email Sweepstakes Tax Refund United Kingdom United Nations UPS Virus Web Design Western Union World Bank

Stop Spam Resources

  • CAN-SPAM Act: A Compliance Guide for Business
  • FBI
  • How to recognize Phishing Scams
  • Looks Too Good To Be True
  • PayPal : Report fake (phishing) email
  • PayPal : Report fake (spoof) websites
  • The Spamhaus Project
  • US-CERT

Identity Theft Resources

  • Equifax
  • Experian
  • FTC Identity Theft Site
  • Identity Theft Protection
  • Recover from Identity Theft Tips
  • Report Internet Fraud
  • TransUnion

Recent Posts

  • Spoofed FBI Internet Domains Pose Cyber and Disinformation Risks
  • Child Abductors Potentially Using Social Media or Social Networks to Lure Victims In Lieu of an In-Person Ruse
  • FBI Cyber Strategy
  • A COVID 19-Driven Increase in Telework from Hotels Could Pose a Cyber Security Risk for Guests
  • Spoofed Internet Domains and Email Accounts Pose Cyber and Disinformation Risks to Voters

Popular Posts

  • Orphanage Donation Email Scam
  • MR Mikeuba Benin Republic FedEx Courier Bank Draft Email Scam
  • 123greetings.com eCard Virus Alert
  • About
  • Fraud Alert: Unauthorized Wire Transfers to China
  • About
  • What is Identity Theft
  • Sitemap
© 2020 SpamScams.net All rights reserved. WordPress updates by Kristof Creative