A recent phishing campaign has been discovered that uses fake copyright claims to deliver the Rhadamanthys stealer malware, a malicious software designed to extract sensitive information from infected computers by communicating with a command-and-control server operated by cybercriminals. This new campaign, named "CopyRh(ight)adamantys," has drawn the attention of security experts as it targets individuals by impersonating legitimate companies and accusing them of copyright infringement on platforms like Facebook.
Fake Copyright Claims as Bait
The cybercriminals behind the CopyRh(ight)adamantys campaign utilize Gmail accounts, claimed to belong to lawyers, to send meticulously tailored emails to the victims. These emails falsely accuse the recipients of misusing the company’s brand and demand the removal of certain images and videos from their websites or social media profiles. However, the true danger lies in the files attached to these emails.
These phishing emails include files with detailed instructions to install what they claim to be a new version of Rhino software. However, instead of Rhino, these files deploy the Rhadamanthys stealer malware onto the victim’s system. This malware is reputed to leverage advanced functionalities such as AI-powered engines, though most sources indicate it actually employs classical machine learning techniques found in OCR software. Additionally, the campaign might use AI to generate many Gmail accounts for sending phishing emails, although these emails occasionally contain inaccuracies like language errors.
The Scale and Scope of the Campaign
According to security experts at CheckPoint, this phishing campaign has a substantial reach, affecting organizations and individuals across multiple regions including the United States, Europe, the Middle East, East Asia, and South America. The campaign disproportionately targets the entertainment, media, technology, and software industries, hinting that the actors behind it are financially motivated rather than nation-state actors. The researchers have stressed the need to raise awareness and support organizations in mitigating this sophisticated cyber threat.
Despite their observations being limited to CheckPoint’s customer base, the massive volume of fake emails indicates a larger operation that could have broader implications. The experts highlighted the importance of recognizing the signs of such emails and understanding the deceptive tactics employed by the threat actors.
Mitigation and Prevention Measures
To guard against such phishing attacks, businesses are urged to implement comprehensive security solutions that offer wide coverage of various attack tactics and file types. CheckPoint also advocates for the running of malware analysis in virtual environments to detect and neutralize threats in real-time. This proactive approach can significantly reduce the risks posed by such attacks.
Conclusion
A recent phishing campaign has come to light, employing fake copyright claims to distribute the Rhadamanthys stealer malware. This malicious software is designed to extract sensitive information from infected systems by connecting to a command-and-control server operated by cybercriminals. Dubbed "CopyRh(ight)adamantys," this new scheme has garnered attention from security experts as it targets unsuspecting individuals by masquerading as legitimate companies and involves accusing users of copyright infringement on popular platforms like Facebook. Upon receiving such a notice, victims are often misled into clicking on links or downloading files that, unbeknownst to them, install the Rhadamanthys stealer. Once this malware infiltrates a computer, it can harvest various types of sensitive data, posing significant risks to users. It is crucial for individuals and organizations to maintain vigilance and employ robust security measures to protect against such sophisticated phishing attempts. Awareness and proactive defense are key tools in combating this evolving cyber threat.