Spear Phishing Targets CEOs

A new phishing threat specifically targeting corporate CEOs has found the perfect means to entice its victims into downloading the virus: by disguising itself as a court subpoena. The threat is sent as a fake court subpoena directing the recipient to a Web site to download court documents. On the site they are prompted to download a browser plug-in to view the documents, and it is this "plug-in" that gives away control of the victim?s computer.

The fake subpoena is apparently quite convincing, as it includes the victim?s name, company, and phone number. However, small details like a British spelling variant can tip off victims that it might not be the real deal.

The Web site that CEOs are sent to also seems legitimate at first. It is set up at an address ending in "uscourts.com" which is similar to the legitimate .gov addresses used by California state courts. The web site delivering the malware is actually based in China, however, and the computer that takes control of the victim computers is based in Singapore.
On Monday the Administrative Office of the U.S. Courts issued a statement warning about the fake subpoenas and stating not to trust e-mail that purport to be court documents but contain links to sites other than uscourts.gov.

Comments

This is serious. I receive legal motion filing notices from a legitimate Texas company using the name uscourts.com. I believe that this is a nationwide alerting service that feeds circuit court notices to subscribers.

The perpetrator is probably the chinese government.

qwester

April 24, 2008

7:30 AM PT