Prominent US financial institutions and other major businesses have been targeted by hackers employing a basic phone scam to steal sensitive data and demand ransoms, according to a Google report.
The cybercriminals, who have used aliases including Redact, Pink, Falcon, and Helix, are reportedly impersonating corporate IT help desk employees. They contact individuals at targeted firms, including Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody’s, tricking them into revealing passwords and security codes.
Google indicated that the attackers have recently shifted their focus towards financial titans, law firms, and financial ratings agencies, which manage substantial capital, making them attractive targets. Austin Larsen, principal threat analyst at the Google Threat Intelligence Group, stated that the motivation is financial, as attackers believe these firms possess data valuable enough to warrant a ransom payment.
The technique used is known as social engineering, which involves manipulating individuals rather than exploiting technical software vulnerabilities. Attackers spoof legitimate internal help desk phone numbers to build trust, then instruct employees to update their security credentials on custom-built websites designed to harvest login information. These fake websites often use domain names such as "passkeyhelpdesk."
Once employees enter their primary passwords, hackers collect temporary, fail-safe passcodes over the phone in real-time, allowing them to hijack corporate accounts before ending the call. Larsen described the method as not sophisticated but highly effective. Cybersecurity experts note the persistent vulnerability of human employees to such low-tech tactics. Lee Clark, a cyberthreat intelligence production manager with the Retail and Hospitality ISAC, likened the approach to tricking a guard into opening a door, emphasizing the human element as the reason for the tactic's proliferation.
Google confirmed that some companies have already paid ransoms to the attackers. Over the past five weeks, the cybercriminals have created digital traps for more than 200 companies, including ride-hailing company Uber, online real estate broker Zillow, and clothing brand Levi Strauss. Law firms Paul Hastings and Greenberg Traurig were also targeted, though Greenberg Traurig confirmed its security protocols successfully protected client data.
Point72 Asset Management informed investors of a recent attack attempt, and sources confirmed that hedge funds Two Sigma Investments and Citadel were also targeted. Companies including KKR, Bain Capital, Clearlake Capital, CME, TPG, Apollo, Point72, and Citadel declined to comment on the Reuters news agency's inquiries.