Fake Airbus emails were used as phishing lure. (Photo: Airbus)
A spear-phishing campaign is targeting aviation companies, using malicious documents that deliver information-stealing malware, according to alerts from Microsoft Security Intelligence.
In a series of alerts posted on Twitter, Microsoft says it has been tracking a dynamic campaign targeting the aerospace and travel sectors with spear-phishing emails that distribute an actively developed loader, which then delivers the remote access Trojan RevengeRAT, aka AsyncRAT.
Microsoft notes the campaign, which has been active in recent months, involves attackers spoofing emails of legitimate organizations with lures relevant to aviation, travel or cargo.
Attack Tactics
Hackers Used Trojanized Xcode to Target macOS Developers databreachtoday.com - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from databreachtoday.com Daily Mail and Mail on Sunday newspapers.
GovInfoSecurity
@prajeetspeaks) • March 5, 2021
Photo: Malaysia Airlines
An aviation IT company that says it serves 90% of the world s airlines has been breached in what appears to be a coordinated supply chain attack. Customers of at least four companies - Malaysia Airlines, Singapore Airlines, Finnair Airlines and Air New Zealand - may have been affected by the incident.
The Switzerland-based IT company, SITA, says passenger data stored on its SITA Passenger Service System server in the U.S. was stolen.
Earlier this week, Malaysia Airlines confirmed personal information belonging to members of its frequent-flyer program, Enrich, was compromised over a nine-year period, tying the incident to its IT service provider, but not naming SITA.