Indian Users Targeted in Tax Phishing Campaign Delivering Blackmoon Malware
As part of a suspected cyber espionage campaign, cybersecurity researchers have found an ongoing campaign that targets Indian consumers with a multi-stage backdoor.
According to the eSentire Threat Response Unit (TRU), the activity entails tricking victims into downloading a malicious archive through phishing emails posing as the Income Tax Department of India. This gives the threat actors permanent access to the victims' computers for ongoing monitoring and data exfiltration.
The complex attack's ultimate objective is to use a genuine enterprise solution called SyncFuture TSM (Terminal Security Management), created by the Chinese company Nanjing Zhongke Huasai Technology Co., Ltd., and a variation of the well-known banking trojan Blackmoon (also known as KRBanker). No known threat ...