[MART] - Daily Diary #403 - FluBot New Campaign Targeting Finland

[CTAS-MAT]

Hello,
I hope everyone is doing well!

Below is the entry for today.

12/02/2021 - Diary entry #403

Covered in our Daily diary #265, FluBot is an Android Malware threat that's been active since 2021. FluBot is a multi-purpose malware, providing an attacker access to SMS messages, push notifications, contact lists, calls, and more. It can even be used as a banking malware, creating overlays to steal user credentials. After infecting a device, the attackers use it to spread SMShing messages (SMS texts with phishing URL links), so other users download the sample and get infected as well.

This week Finland's National Cyber Security Centre (NCSC-FI) issued a warning to citizens about FluBot newest campaign. This is not the first time FluBot makes a campaign in Finland. On June 2021, another warning was raised, after thousands of users were affected by a campaign disguised as a DHL SMS message. This alert was discontinued in August.

FluBot is yet another example of how careful users need to be when installing apps from unknown sources. FluBot campaigns have been found in lots of countries around the world, always using SMS as a main infection vector. Therefore, caution with links received through messages is also advised, even from trusted sources.

Kind Regards,

[https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png]<https://www.appgate.com/>

[https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png]<https://www.linkedin.com/company/appgate-security/>     [https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png] <https://twitter.com/AppgateSecurity>   [https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png] <https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ>



Felipe Duarte Domingues
Security Researcher
Appgate

E: felipe.duarte at appgate.com<mailto:felipe.duarte at appgate.com>
O: +55 19 98840 2509

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/mart/attachments/20211202/55dd79a0/attachment.htm>