FlagThis - #unspecified

The FBI has issued a warning about the rising trend of cybercriminals using fake file converter tools to distribute malware. These tools, often advertised as free online document converters, are designed to trick users into downloading malicious software onto their computers. While these tools may perform the advertised file conversion, they also secretly install malware that can lead to identity theft, ransomware attacks, and the compromise of sensitive data.

The threat actors exploit various file converter or downloader tools, enticing users with promises of converting files from one format to another, such as .doc to .pdf, or combining multiple files. The malicious code, disguised as a file conversion utility, can scrape uploaded files for personal identifying information, including social security numbers, banking information, and cryptocurrency wallet addresses. The FBI advises users to be cautious of such tools and report any instances of this scam to protect their assets.

The FBI Denver Field Office is warning that they are increasingly seeing scams involving free online document converter tools and encourages victims to report any instances of this scam. Malwarebytes has identified some of these suspect file converters, which include Imageconvertors.com, convertitoremp3.it, convertisseurs-pdf.com and convertscloud.com. The agency emphasized the importance of educating individuals about these threats to prevent them from falling victim to these scams.


References :

• Talkback Resources: FBI warns of malware-laden websites posing as free file converters, leading to ransomware attacks and data theft.
• gbhackers.com: Beware! Malware Hidden in Free Word-to-PDF Converters
• www.bitdefender.com: Free file converter malware scam “rampantâ€� claims FBI
• Malwarebytes: Warning over free online file converters that actually install malware
• bsky.app: Free file converter malware scam "rampant" claims FBI.
• bsky.app: @bushidotoken.net has dug up some IOCs for the FBI's recent warning about online file format converters being used to distribute malware
• Help Net Security: FBI: Free file converter sites and tools deliver malware
• www.techradar.com: Free online file converters could infect your PC with malware, FBI warns
• bsky.app: Free file converter malware scam "rampant" claims FBI.
• Security | TechRepublic: Scam Alert: FBI ‘Increasingly Seeing’ Malware Distributed In Document Converters
• securityaffairs.com: The FBI warns of a significant increase in scams involving free online document converters to infect users with malware. The FBI warns that threat actors use malicious online document converters to steal users’ sensitive information and infect their systems with malware.
• The DefendOps Diaries: FBI warns against fake file converters spreading malware and stealing data. Learn how to protect yourself from these cyber threats.
• PCMag UK security: PSA: Be Careful Around Free File Converters, They Might Contain Malware
• www.bleepingcomputer.com: FBI warnings are true—fake file converters do push malware
• www.techradar.com: FBI warns some web-based file management services are not as well-intentioned as they seem.
• www.csoonline.com: Improvements Microsoft has made to Office document security that disable macros and other embedded malware by default has forced criminals to up their innovation game, a security expert said Monday.
• www.itpro.com: Fake file converter tools are on the rise – here’s what you need to know
• Cyber Security News: The FBI Denver Field Office has warned sternly about the rising threat of malicious online file converter tools. These seemingly harmless services, often advertised as free tools to convert or merge files, are being weaponized by cybercriminals to install malware on users’ computers. This malware can have devastating consequences, including ransomware attacks and identity theft. […]

Classification:

• HashTags: #Malware #FileConverter #Cybersecurity
• Company: FBI
• Target: Users
• Attacker: FBI
• Product: File converter tools
• Feature: Fake file converters
• Type: Malware
• Severity: Medium

A critical authentication bypass vulnerability, identified as CVE-2024-53704, in SonicWall firewalls is under active exploitation. Security firms are warning that attackers are now targeting this flaw following the public release of proof-of-concept exploit code. The vulnerability allows attackers to bypass authentication, posing a significant risk to affected systems.

Security updates are available for download to address the issue, and users are strongly urged to patch their SonicWall firewalls immediately. Attacks are currently taking place, making prompt action essential to mitigate potential exploits. The vulnerability highlights the importance of keeping security infrastructure up-to-date to defend against emerging threats.


References :

• BleepingComputer: Attackers are now targeting an authentication bypass vulnerability affecting SonicWall firewalls shortly after the release of proof-of-concept (PoC) exploit code.
• Anonymous ???????? :af:: Attackers are now targeting an authentication bypass vulnerability affecting SonicWall firewalls shortly after the release of proof-of-concept (PoC) exploit code.
• heise online English: Patch Sonicwall now! Attackers bypass authentication of firewalls Attacks are currently taking place on Sonicwall firewalls. Security updates are available for download.

Classification:

• HashTags: #SonicWall #Firewall #Vulnerability
• Company: SonicWall
• Target: SonicWall users
• Attacker: Unspecified
• Product: SonicWall firewalls
• Feature: Authentication Bypass
• Type: 0Day
• Severity: Major

India's central bank, the Reserve Bank of India (RBI), is set to introduce the exclusive "bank.in" domain for banks, a strategic move aimed at combating the rising tide of digital financial fraud. This initiative intends to significantly reduce cybersecurity threats and malicious activities such as phishing. The goal is to streamline secure financial services to enhance trust in digital banking and payment systems. With over 2,000 banks currently operating in India, assigning them an exclusive domain is expected to make it harder for fraudsters to create fake bank websites and lure victims.

This plan was detailed in a policy update, addressing the "significant concern" around increased digital payment fraud in India. Registration for bank.in domains is scheduled to commence in April. The RBI is also planning a separate domain, "fin.in," for other non-bank entities in the financial sector. To further enhance trust in online payments, the RBI is also introducing Additional Factor Authentication (AFA) for cross-border card-not-present online transactions. The Institute for Development and Research in Banking Technology (IDRBT) will serve as the exclusive registrar.


References :

• The Register - Security: With over 2,000 banks in operation, the potential to make life harder for fraudsters is obvious India’s Reserve Bank last week announced a plan to use adopt dedicated second-level domains – bank.in and fin.in – in the hope it improves trust in the financial services sector.…
• The Hacker News: India’s RBI Introduces Exclusive "bank.in" Domain to Combat Digital Banking Fraud
• The Register: India wants all banking to happen at dedicated bank.in domain With over 2,000 banks in operation, the potential to make life harder for fraudsters is obvious India’s Reserve Bank last week announced a plan to use adopt dedicated second-level domains – bank.in and fin.in – in the hope it improves trust in the financial services sector.…
• Techmeme: Techmeme post on the India's bank.in plan.

Classification:

• HashTags: #India #Banking #Fraud
• Company: India
• Target: Digital banking in India
• Attacker: Unspecified
• Product: bank.in
• Feature: Bank.in Domain
• Type: News
• Severity: Medium