Swiss Post CERT

CERT-Team @swisspost / @postschweiz
Cyber Defence for / AS12511
FIRST member @FIRSTdotOrg

#Phishing #Malware #Hacking #ITsecurity #DFIR

[TomU | I'm still here... til the end 🕊️🇨🇭 @c_APT_ure]

Thanks Corsin .@cocaman & Andre .@AndreGironda for great sharing on @abuse_ch Bazaar, ThreatFox & URLhaus!

This is a rather interesting #AsyncRAT campaign.

Spoofing @swisspost & @USPS as sender
CC: @SwissPost_CERT & @OIGUSPS

🧵 1/

#MalwareChallenge

[Swiss Post CERT @SwissPost_CERT]

@cynicalsecurity @swisspost Thanks for letting us know. 👍
Contacted via DM to get more details.
^tu

[Swiss Post CERT @SwissPost_CERT]

Be aware of current patterns of fraud:
Swiss Post does not process payments
via post[.]ch[.]paysget[.]info.

Find out more ⬇️
https://t.co/C4u3iZZJ3G

[Swiss Post CERT @SwissPost_CERT]

@mylaocoon Besten Dank Candid für die Meldung!

Wir kümmern uns um die Phishing Domains.

[Swiss Post CERT @SwissPost_CERT]

@FrPhishing @abuse_ch Thanks for your notification. Takedown process has been initiated 2021-01-26 18:17 CET, and escalated again today.

[Swiss Post CERT @SwissPost_CERT]

@mylaocoon Late thanks for the headsup. Notified roughly 200 phishing sites this month mimicking Swiss Post.

[abuse.ch @abuse_ch]

https://t.co/b7WQ1Ihzpw: Time to move forward. Your help is needed ⛑️

👉 https://t.co/uy0x9KpZRg

[Swiss Post CERT @SwissPost_CERT]

@ninoseki Thanks as always for the notification / mention!

We also just found this blog (in German), but not sure if it's the same sample or malware.
No real IOCs, but nice screenshots and earlier waves (from Aug & May 2020) linked at the bottom as well.

https://t.co/vmBSmCSRty

[Swiss Post CERT @SwissPost_CERT]

@akulhanek Danke für die Meldung! (und auch noch ans CERT Team 👍)

Wir versuchen laufend solche Phishing Seiten schnell vom Netz nehmen zu können.

[Swiss Post CERT @SwissPost_CERT]

@s_metanka @ninoseki Thanks both for the information!

Yes, looks like ES & CU targeting also.

[Swiss Post CERT @SwissPost_CERT]

@ninoseki Thank you @ninoseki for the heads-up!

[smtnk @s_metanka]

New blog: This year the cybercrime group #RoamingMantis has been actively targeting the European users of both #iOS and #Android devices. This post provides an insight into the rate of success in their recent advancements. https://t.co/WWKz50wxhE #Malware #Phishing @csis_cyber

[Swiss Post CERT @SwissPost_CERT]

@ninoseki @cybereason @CyberCSIS We're always interested to find out more about #FakeSpy campaigns involving @SwissPost impersonations.

Please mention @SwissPost_CERT to notify us.

[にのせき @ninoseki]

I believe #RoamingMantis is a name of a campaign (which is named by Kaspersky GReAT). It is not a group.
But recently I saw some reports which use #RoamingMantis as a name of a group.
e.g.
https://t.co/XgVlrqOJNS
(by @cybereason)
https://t.co/o7y8Kt6yka
(by @CyberCSIS)

[Virus Bulletin @virusbtn]

CSIS researcher (and past VB conference speaker) @s_metanka looked at how the RoamingMantis Android malware is now targeting European countries too and how the same group is engaging in Apple ID phishing https://t.co/VSlaG6SicW

[Swiss Post CERT @SwissPost_CERT]

@papa_anniekey Thanks for the hint!
We believe there likely is a connection.

There is some great and interesting info in this #RoamingMantis presentation from @BotConf 2019
https://t.co/fgyr4orEqw

[Swiss Post CERT @SwissPost_CERT]

cybercrimepolice:
"Angebliche Paketlieferung mit Code per SMS freischalten"
https://t.co/9nMhjskG0q
#phishing #betrug

[INSTITUT TREUHAND 4.0 @treuhand40]

Betrüger geben sich als @postschweiz aus und versuchen Spionage App zu verteilen…

https://t.co/oJZLTFgVWF

#sicherheit #malware #phishing #malware

[TomU | I'm still here... til the end 🕊️🇨🇭 @c_APT_ure]

@midnight_comms Thanks for the heads-up!

I will take this up with @SwissPost_CERT

We've been seeing an uptick of #FakeSpy Android Malware recently.

[GovCERT.ch @GovCERT_CH]

Vorsicht vor gefälschten E-Mails im Namen der Eidgenössischen Steuerverwaltung ESTV: Beim Excel Anhang handelt es sich um Schadsoftware #guloader. Nicht öffnen!