Security Brief: Actor Uses Compromised Accounts, Customized Social Engineering to Target Transport and Logistics Firms with Malware

Category	Details
Threat Actors	Not currently attributed to a specific threat actor. Infrastructure overlaps with suspected UAC-0050 activity but no confirmed relation.
Campaign Overview	Activity targeting North American transportation and logistics companies using compromised email accounts to inject malware into ongoing email threads.
Target Regions (Victims)	North America; specifically transportation and logistics industries.
Methodology	- Compromised legitimate email accounts. - Injecting malicious links/files into existing email threads. - Utilizing Google Drive URLs, .URL files, and “ClickFix” techniques with Base64-encoded PowerShell scripts.
Product Targeted	Logistics and fleet management software (e.g., Samsara, AMB Logistic, Astra TMS).
Malware Reference	Lumma Stealer, StealC, NetSupport, DanaBot, Arechclient2.
Tools Used	- Google Drive for URL hosting. - SMB protocol for malware execution. - “ClickFix” technique for malware delivery via PowerShell scripts.
Vulnerabilities Exploited	Not specified.
TTPs	- Social engineering (compromised email accounts). - Malicious content injection into legitimate email threads. - Use of commodity malware payloads.
Attribution	Moderately assessed as financially motivated cybercriminals leveraging third-party infrastructure.
Recommendations	- Verify emails from known senders if content seems unusual. - Be cautious of email links and attachments (.URL files, Google Drive links). - Educate users on detecting suspicious emails.
Source	Proofpoint

Read full article: https://www.proofpoint.com/us/blog/threat-insight/security-brief-actor-uses-compromised-accounts-customized-social-engineering

Disclaimer: The above summary has been generated by an AI language model