New Malware Attack Tries To Trick People By Pretending To Be EFF

from the who-are-they-targeting? dept

The Electronic Frontier Foundation has put out an alert noting that, as part of a larger spear phishing attack campaign, to try to gain control over computers, a group has created a fake EFF website, designed to trick people into thinking they’re going to EFF’s actual website, but really installing some pretty nasty malware. was not the only domain involved in this attack. It seems to be part of a larger campaign, known as ?Pawn Storm?. The current phase of the Pawn Storm attack campaign started a little over a month ago, and the overall campaign was first identified in an October 2014 report from Trend Micro (PDF). The group behind the attacks is possibly associated with the Russian government and has been active since at least 2007.

The attack is relatively sophisticated?it uses a recently discovered Java exploit, the first known Java 0-day in two years. The attacker sends the target a spear phishing email containing a link to a unique URL on the malicious domain (in this case When visited, the URL will redirect the user to another unique URL in the form of{6_random_digits}/Go.class containing a Java applet which exploits a vulnerable version of Java. Once the URL is used and the Java payload is received, the URL is disabled and will no longer deliver malware (presumably to make life harder for malware analysts). The attacker, now able to run any code on the users machine due to the Java exploit, downloads a second payload, which is a binary program to be executed on the target’s computer.

Needless to say, don’t visit the site unless you know what you’re doing — and also, a good reminder not to click on URLs in emails. Go directly to sites.

Filed Under: , ,
Companies: eff

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “New Malware Attack Tries To Trick People By Pretending To Be EFF”

Subscribe: RSS Leave a comment
DocGerbil100 (profile) says:

Re: Re: Re:

Oh, for fuck’s sake.

Hello, Sheogorath. In the absence of anything else to do about it, I’ve hit Report. I suggest you and everyone else do the same.

Dear Techdirt, this page is now permanently serving Russian government malware, until you manually remove or alter the link. Well done.

As a strategy for dealing with this kind of issue in the longer term, I suggest you learn to FUCKING EDIT BUTTON, already. >:/

ltlw0lf (profile) says:

Re: Re: Re:

It seems the first link is active even though I didn’t use tags. Please don’t click on it because I don’t think it’s safe.

I don’t see it as a link, but that is probably because I have disabled most of the javascript served up by Techdirt (unless Mike has already removed the tags.)

Then again, I occasionally submit comments with tags where it strips one or more of the tags (or, far more likely, I break it somehow,) leaving my comment with an unlinked link, but figure that if folks really want to follow it, they can copy and paste.

Sheogorath (profile) says:

Re: Re: Re: Re:

I don’t see it as a link, but that is probably because I have disabled most of the javascript served up by Techdirt […]
It’s been fixed since.
[…] (unless Mike has already removed the tags.)
There weren’t any tags in the first place. I used tags on the official EFF website link, yes, but not on the fake EFF website link above it because it was my intention not to link to the fake site at all.

Anonymous Coward says:

Good reminder, but I have a better one

also, a good reminder not to click on URLs in emails.

This is a great reminder not to allow Java applets to run on sites until you understand exactly why you need it. If you are one of those lucky people who never interacts with sites that legitimately need Java, then you should completely block it in the browser.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...