{"id":1060,"date":"2017-10-08T11:30:09","date_gmt":"2017-10-08T08:30:09","guid":{"rendered":"https:\/\/community.virtono.com\/?p=1060"},"modified":"2020-06-10T16:49:35","modified_gmt":"2020-06-10T13:49:35","slug":"freemilk-new-phishing-campaign-to-hijack-email-conversations","status":"publish","type":"post","link":"https:\/\/www.virtono.com\/community\/internet-and-technology-news\/freemilk-new-phishing-campaign-to-hijack-email-conversations\/","title":{"rendered":"FreeMilk : New phishing campaign to hijack email conversations"},"content":{"rendered":"<p>A new threat has been identified by\u00a0\u00a0Palo Alto Networks security researchers, it is a\u00a0phishing campaign used by hackers to intercept ongoing email conversations between individuals and hijack them to deploy malware.The focus on even now believes they are in contact with the particular person they had been at first messaging, but in actuality, they have fallen sufferer to a really specific cyber assault and may possibly have contaminated their community by using a destructive attachment.<\/p>\n<p>Assaults utilizing this approach and have currently infiltrated a number of networks, including all those of a Middle Japanese lender, European mental expert services firms, an intercontinental sporting organization and \u2018individuals with indirect ties to a nation in North East Asia\u2019.In this attack, threat actors intercept a legitimate, ongoing conversation between two recipients and pose as one of them using messages that seem as if the victim is still communicating with the original person they were emailing.<\/p>\n<p>According to\u00a0Palo Alto Networks Team upon successful exploitation, the malicious document delivered two malware payloads PoohMilk and Freenki.<\/p>\n<p><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" data-attachment-id=\"1061\" data-permalink=\"https:\/\/www.virtono.com\/community\/internet-and-technology-news\/freemilk-new-phishing-campaign-to-hijack-email-conversations\/attachment\/freemilk_1\/\" data-orig-file=\"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/FreeMilk_1.png?fit=571%2C879&amp;ssl=1\" data-orig-size=\"571,879\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"FreeMilk_1\" data-image-description=\"\" data-image-caption=\"\" data-large-file=\"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/FreeMilk_1.png?fit=571%2C879&amp;ssl=1\" class=\"alignnone  wp-image-1061\" src=\"https:\/\/i0.wp.com\/community.virtono.com\/wp-content\/uploads\/2017\/10\/FreeMilk_1-195x300.png?resize=695%2C1069&#038;ssl=1\" alt=\"\" width=\"695\" height=\"1069\" srcset=\"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/FreeMilk_1.png?resize=195%2C300&amp;ssl=1 195w, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/FreeMilk_1.png?w=571&amp;ssl=1 571w\" sizes=\"auto, (max-width: 695px) 100vw, 695px\" \/><\/p>\n<p>The targeted victims in this campaign we identified include:<\/p>\n<ul>\n<li>a bank based in the Middle East<\/li>\n<li>trademark and intellectual property service companies based in Europe<\/li>\n<li>an international sporting organization<\/li>\n<li>individuals with indirect ties to a country in North East Asia<\/li>\n<\/ul>\n<p>&#8220;The threat actor tried to stay under the radar by making malware that only executes when a proper argument is given, hijacked an existing email conversation and carefully crafted each decoy document based on the hijacked conversation to make it look more legitimate,&#8221; researchers said.<\/p>\n<p>The exploit makes it possible for attackers to acquire complete handle of an contaminated procedure \u2013 probable by means of credential theft \u2013 then intercept in-development conversations with precise targets utilizing cautiously crafted information intended to fool them into putting in malware from what the sufferer believes to be reliable supply.In a number of instances, researchers said the PoohMilk loader was used to load N1stAgent, a remote administration tool that was first seen in a phishing campaign in 2016 that used phishing emails disguised as Hancom&#8217;s security patch.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new threat has been identified by\u00a0\u00a0Palo Alto Networks security researchers, it is a\u00a0phishing campaign used by hackers to intercept ongoing email conversations between individuals and hijack them to deploy malware.The focus on even now believes they are in contact with the particular person they had been at first messaging,<\/p>\n","protected":false},"author":4,"featured_media":1061,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[25],"tags":[],"class_list":["post-1060","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-internet-and-technology-news"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/FreeMilk_1.png?fit=571%2C879&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7ISfL-h6","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":760,"url":"https:\/\/www.virtono.com\/community\/knowledgebase\/3-major-challenges-in-cloud-security\/","url_meta":{"origin":1060,"position":0},"title":"3 major challenges in Cloud security","author":"Daniel Draga","date":"November 17, 2016","format":false,"excerpt":"Is your institution planning to leverage cloud computing and mobile computing in order to improve service agility, increase increase student and research success and lower costs of ownership, and lower capital expenses? If so, you are no doubt aware that your institution is also increasing its attack surface. Cloud-based technologies,\u2026","rel":"","context":"In &quot;Knowledgebase&quot;","block_context":{"text":"Knowledgebase","link":"https:\/\/www.virtono.com\/community\/category\/knowledgebase\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/Cloud-security.jpg?fit=1200%2C800&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/Cloud-security.jpg?fit=1200%2C800&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/Cloud-security.jpg?fit=1200%2C800&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/Cloud-security.jpg?fit=1200%2C800&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/Cloud-security.jpg?fit=1200%2C800&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":2878,"url":"https:\/\/www.virtono.com\/community\/internet-and-technology-news\/what-is-phishing-dont-bite-the-bait%ef%bf%bc\/","url_meta":{"origin":1060,"position":1},"title":"What is Phishing, don\u2019t bite the bait!\ufffc","author":"Stefan Dutu","date":"July 20, 2022","format":false,"excerpt":"What do you imagine a phishing attack looks like? If your answer has anything to do with a fish or fishing pole I have bad news for you\u2026 In this instance, we\u2019re spelling \u201cfishing\u201d with a PH, and this method is one of the most common online scams around. So\u2026","rel":"","context":"In &quot;IT News&quot;","block_context":{"text":"IT News","link":"https:\/\/www.virtono.com\/community\/category\/internet-and-technology-news\/"},"img":{"alt_text":"Phishing illustration","src":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2022\/07\/dont-bite-the-bait.png?fit=1200%2C675&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2022\/07\/dont-bite-the-bait.png?fit=1200%2C675&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2022\/07\/dont-bite-the-bait.png?fit=1200%2C675&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2022\/07\/dont-bite-the-bait.png?fit=1200%2C675&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2022\/07\/dont-bite-the-bait.png?fit=1200%2C675&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":784,"url":"https:\/\/www.virtono.com\/community\/tutorial-how-to\/targeted-attacks\/","url_meta":{"origin":1060,"position":2},"title":"Targeted Attacks.","author":"Daniel Draga","date":"December 2, 2016","format":false,"excerpt":"More Data than Sense. As we look at the responses, most of these detection and correction efforts combine human expertise with tools and data. All efforts can be improved through access to and better interpretation of relevant data, policy-based workflows, and appropriate and facilitated automation. So what\u2019s holding these valiant\u2026","rel":"","context":"In &quot;Knowledgebase&quot;","block_context":{"text":"Knowledgebase","link":"https:\/\/www.virtono.com\/community\/category\/knowledgebase\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":744,"url":"https:\/\/www.virtono.com\/community\/knowledgebase\/ways-to-guard-a-vanishing-network-perimeter\/","url_meta":{"origin":1060,"position":3},"title":"WAYS TO GUARD A VANISHING NETWORK PERIMETER","author":"Daniel Draga","date":"November 8, 2016","format":false,"excerpt":"WITH DISTRIBUTED WORKFORCES and mobile technologies, the network perimeter has evolved beyond the physical limits of most corporate campuses. The days when the perimeter was an actual boundary are a fond memory. Back then, firewalls did a decent job of protecting the network from outside threats, and intrusion prevention tools\u2026","rel":"","context":"In &quot;Knowledgebase&quot;","block_context":{"text":"Knowledgebase","link":"https:\/\/www.virtono.com\/community\/category\/knowledgebase\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/itsecurity.jpg?fit=1200%2C900&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/itsecurity.jpg?fit=1200%2C900&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/itsecurity.jpg?fit=1200%2C900&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/itsecurity.jpg?fit=1200%2C900&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2016\/11\/itsecurity.jpg?fit=1200%2C900&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":1040,"url":"https:\/\/www.virtono.com\/community\/internet-and-technology-news\/locky-ransomwares-authors-big-fans-of-game-of-thrones\/","url_meta":{"origin":1060,"position":4},"title":"Locky Ransomware&#8217;s Authors : Big Fans of Game Of Thrones","author":"Daniel Draga","date":"September 26, 2017","format":false,"excerpt":"One of the most viewed T.V shows of our time\u00a0Game Of Thrones has found its viewers in all forms of diversities the most recent ones are criminal-type more particularly the Authors of\u00a0Locky Ransomware. Researchers at PhishMe have found the names of various\u00a0Game Of Thrones characters and other references in the\u2026","rel":"","context":"In &quot;IT News&quot;","block_context":{"text":"IT News","link":"https:\/\/www.virtono.com\/community\/category\/internet-and-technology-news\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/09\/WhatsApp-Image-2017-09-25-at-07.12.16.jpeg?fit=768%2C254&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/09\/WhatsApp-Image-2017-09-25-at-07.12.16.jpeg?fit=768%2C254&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/09\/WhatsApp-Image-2017-09-25-at-07.12.16.jpeg?fit=768%2C254&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/09\/WhatsApp-Image-2017-09-25-at-07.12.16.jpeg?fit=768%2C254&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":1171,"url":"https:\/\/www.virtono.com\/community\/internet-and-technology-news\/aws-and-microsoft-introduce-a-source-driven-ai-interface\/","url_meta":{"origin":1060,"position":5},"title":"AWS and Microsoft introduce a source-driven AI interface","author":"Shreyash Sharma","date":"October 25, 2017","format":false,"excerpt":"Gluon is another step towards standardized\u00a0APIs\u00a0for neural networks.\u00a0The interface is compatible with both\u00a0Microsoft's\u00a0Cognitive Toolkit and\u00a0Apache\u00a0Mxnet.\u00a0It scales with more than 500 GPUs and is intended to deal with little rather than much data. Microsoft\u00a0and\u00a0Amazon Web Services (AWS)\u00a0co-operate and jointly present the deep-learning interface Gluon.\u00a0Both companies have issued an online report.\u00a0Gluon will\u2026","rel":"","context":"In &quot;IT News&quot;","block_context":{"text":"IT News","link":"https:\/\/www.virtono.com\/community\/category\/internet-and-technology-news\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/20130906170823-0_0_0.jpg?fit=980%2C560&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/20130906170823-0_0_0.jpg?fit=980%2C560&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/20130906170823-0_0_0.jpg?fit=980%2C560&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.virtono.com\/community\/wp-content\/uploads\/2017\/10\/20130906170823-0_0_0.jpg?fit=980%2C560&ssl=1&resize=700%2C400 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/posts\/1060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/comments?post=1060"}],"version-history":[{"count":3,"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/posts\/1060\/revisions"}],"predecessor-version":[{"id":1064,"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/posts\/1060\/revisions\/1064"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/media\/1061"}],"wp:attachment":[{"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/media?parent=1060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/categories?post=1060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.virtono.com\/community\/wp-json\/wp\/v2\/tags?post=1060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}