Some cyberattacks involve extremely sophisticated tools and cutting-edge exploits. Others, not so much.
A case in point is an incident involving a Chinese venture capital firm and an Israeli startup that it had agreed to fund. Nearly all it took for scammers to walk away with a cool $1 million in cash — meant for the startup from the investment firm — was two Web domains and 32 emails.
Check Point Software, which investigated the scam on behalf of the Israeli firm, this week described the incident as starting with a compromise of the Israeli startup's email server. A few months before the transaction was scheduled to happen, the attackers noticed an email thread containing information about a multimillion-dollar seeding fund from the Chinese VC.
Rather than simply monitoring the thread and having emails forwarded to them, the attackers registered two domains. One of the domains was a look-alike of the Chinese investment company's domain; the other was a spoof of the Israeli firm's domain. In both instances, the threat actors simply added an "s" to the end of the original domain name.
The next phase of the scam involved the attackers sending two emails with the same subject header as the original email thread about the planned seed funding.
The attackers used the Israeli firm's look-alike domain to send an email to the Chinese VC firm that appeared to be from the startup's CEO. They also used the Chinese firm's look-alike domain to send an email to the Israeli company that purported to be from the email account of the manager in charge of the transaction at the investment firm.
"This infrastructure gave the attacker the ..
Support the originator by clicking the read the rest link below.
