Every year, the number of phishing scams seems to be increasing, with the malware-ridden emails getting continually more sophisticated and convincing. The latest global phishing campaign purporting to be from international courier giants DHL has been tricking users into opening a fake PDF attachment – and subsequently unleashed a previously unseen piece of malware to wreak havoc on their PCs.
Cyber criminals are taking advantage of DHL’s worldwide reputation and brand recognition in order to distribute a previously unseen strain of malware, named Muncy. Once the user downloads the fake PDF attachment, the trojan sneaks onto their PC and begins scanning the C:/ drive for any files containing sensitive data.
Once it has completed its scan, it then sends back any data found to the criminals’ server, where they can attempt to steal the user’s money, impersonate them to commit identity fraud, or even request a ransom from them to not release the data publicly.
So how do I recognise this email if I get it? Well, the first question you should ask yourself if you receive a mail from DHL is if you’re expecting a parcel from them. Getting a parcel delivery notice when you’re not expecting any deliveries is always a sign that the email may not be genuine.
For this scam in particular, they have taken advantage of some of DHL’s mail servers to make the emails appear as if they are coming from support@dhl(.)com, so they can look quite genuine. The subject of the email is reported to be ‘DHL SHIPMENT NOTIFICATION’, although this may be subject to change if people start to catch on.
The most important thing to bear in mind is to never open links or download attachments in emails that you suspect are not genuine. Most companies like DHL will instead email you a tracking number that you can independently put into their website to see where your delivery is, not send you a PDF out of the blue. Almost any attachment can be dangerous (.txt files are usually safe, but even these have been exploited to contain malware now). That means not just .exe files can execute themselves on your PC and install malware.
If in doubt, throw it out. Be sure to always think before you click anything in an email. If someone, even a trusted friend or colleague, sends you an email asking you to do something you wouldn’t normally, confirm with them over the phone (not text) or in person before you take any actions.
Phishing scams are getting increasingly sophisticated and common, fooling the filters of consumer-based email providers such as Gmail and Hotmail, and even slinking past corporate providers such as Office365 and some advanced email filtering solutions.
For businesses, we would strongly advise cyber security awareness training be provided to all staff as a key tenet of your security practices – doing so can be the difference between avoiding a cyber attack and being the subject of a costly data breach and GDPR fine.