Hello world, squid game is being exploited as part of a social engineering campaign by
cybercriminals to infect victims with malware and steal their banking credentials. A new
report by the cybersecurity company “proofpoint” uncovers this scam.
People have been receiving emails pretending to be from Netflix with the subject line “Get
early access to Squid Game season 2”. Now, we all know what it’s like to finish an
episode, only to realise that’s the last one in the series, so no doubt this email
was a pretty good attention grabber. The email reads “Hi Customer, get early access to
the new season of Squid game”, “New story line, new game, new challenges”, “Please
fill out a short document to gain access”. We’ll get to that boobytrapped excel document
in a moment. But this is a great example of a typical low effort phishing campaign we
often see from cybercriminals.
Not a bit of effort has been put into making this email look anything like a genuine Netflix
email, and it really shows - I can’t understand why cybercriminals wouldn’t put 5 minutes
of work into at least replicating the standard netflix email template. But I’m not going
to complain, it makes it easier for you and I to identify these scammers.
Another variation of this email being spread by threat actor 575 - the name of the cybercriminal
gang helming this campaign, is titled “Squid game upcoming season commercials talent casting”
- that word salad of a subject line leads you to yet another low effort phishing email,
attempting to trick you into believing you’ve been chosen to apply to be in the next season
of squid game. The email pushes you to open the attached excel document, saying you need
to fill in the form and return it to be in with a chance of being in season 2.
The trap here lies within that attached excel spreadsheet, open the document and it will
prompt you to enable macros - a familiar foe we on this channel encounter way too often.
I’m not going to explain what macros are in great detail here, for that see my other
video “hacked by a spreadsheet”. But essentially macros allow custom code to be embedded within
a document, this feature of microsoft office is typically used by... companies to perform
complex tasks, and by cybercrooks that want to pwn your pc.
By enabling macros, in this case you’re giving malicious code free reign to download
the “Dridex” malware onto your computer. This “Dridex” malware is hosted on Discord’s
CDN - using Discord to host nefarious files has only become more popular in the past couple
of years, cybercrooks need somewhere to host their wares, and given Discord typically hosts
files in perpetuity, is free and provides a direct download link it’s become the file
hoster of choice for bad actors. I’ve also made a whole video on Discord’s misuse as
a malware hoster, I’ll link it in the description.
As explained by proofpoint “Dridex is a prolific banking trojan”. It typically acts
as a keylogger, scooping up credentials and reporting them back to an attacker-controlled
server from where they can be exploited or sold on. Dridex usually focuses on banking
login details, such as paypal login information. “Dridex first made its appearance around
2011-2012.” - so it’s been around for quite some time. Two members of the Dridex
gang were charged in 2019, but have never been found or arrested. One of these members,
supposedly the leader of the group, is on the FBI’s most wanted list and is sought
after for a range of cyber crimes.
As is the trend with malware these days, Dridex is run as an affiliate program, meaning the
developers of the malware recruit other criminals, usually through cybercrime forums to spread
Dridex, giving these affiliates a hefty slice of the profits, often up to 80%. The particular
copy of Dridex used in this campaign had the “affiliate id “22203””.
Cybercrooks typically prey on trends to spread malware, anything they think will tempt you
into opening an email, today it’s squid game, tomorrow it could be something completely
different. Let me know in the comments, what’s the most audacious phishing email you’ve
ever received?
This video is sponsored by roboForm. The easiest thing you can do to level up your security
is use a password manager. Roboform keeps your passwords encrypted until you need them
and notifies you if any of your passwords have been included in a data breach helping
you stay secure. Roboform is one of the og-est password managers, they’ve been around since
the 90’s - I also use them myself.
Use the link in the description to grab 30% off an annual subscription, bringing it to
just $16, and there’s a 30 day refund policy if you aren’t happy with roboform for any
reason.
If you enjoy this kind of video make sure to help me out by caressing the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on how
one security researcher managed to pwn 70% of the WiFi networks in his city.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.