Smartphones become attractive 'bait' for hackers
Right in the first days of the new year of Giap Thin 2024, security firm Group-IB announced the discovery of GoldPickaxe, the first version of trojan (malicious code, malicious software) created to target iOS users.
Identified as focusing on attacking iOS mobile devices of users in Vietnam and Thailand, the GoldPickaxe malware is capable of collecting facial data, other identification documents and intercepting SMS messages on iPhones. With the appearance of the GoldPickaxe malware, the highly secure iPhone is no longer safe.
In the picture of Vietnam's network information security last year, experts also assessed one of the highlights was the campaign to trick people into installing fake applications of the Government and the General Department of Taxation to appropriate assets. Taking advantage of Google's Accessibility Service in Android, hackers programmed malware to read content and interact with other applications on users' smartphones. After tricking users into granting Accessibility rights to fake applications, the hacker's malware can lie dormant as a spy, collect information, and even control banking applications, thereby carrying out acts of appropriating accounts.
Talking to VietNamNet reporters, Vietnamese information security experts also commented that, in the context of strong digital transformation taking place today, smartphones are increasingly important to many people in both life and work, and therefore they have also become an attractive 'bait' for hackers.
Stating that this year will be a key year for mobile security, VSEC experts explained: With the widespread use of mobile phones today, 2023 has seen an increase in attacks that exploit vulnerabilities and applications on users' phones to steal login information, thereby stealing money from victims' bank accounts.
Sharing the same view, Mr. Vu Ngoc Son, Technical Director of NCS Company, said: This year, smartphone users will have to face more types of malware that can penetrate, exploit vulnerabilities, and take control of phones, including phones running Android and iOS operating systems.
“Taking control of the phone will allow hackers to monitor, eavesdrop, and steal information and data, including accounts and passwords, and from there withdraw money from the user's account or blackmail the user,” Mr. Vu Ngoc Son analyzed.
To avoid the risk of losing information security online, experts recommend that smartphone users limit access to websites of unknown origin, do not click on strange links, and especially do not install applications of unknown origin. Users also need to regularly update information, warnings, especially signs of online fraud to be able to proactively prevent risks.
Main targets of APT attacks
Making predictions about prominent cyber attack trends in 2024, experts from Viettel Cyber Security, Bkav, NCS, and VSEC also stated that APT targeted attacks will continue to increase sharply.
According to Bkav experts, this year, APT attacks continue to increase as important data of organizations and businesses are always the target of cyber criminals around the world. On the other hand, APT attacks in the coming time will not only be more complex but also the level of threat will be more serious, aiming to steal and encrypt important data. This requires strengthening the security defense of information systems, especially important systems that store a lot of data.
Viettel Cyber Security experts said that in 2024, APT attack groups will continue to upgrade and develop tools and malware used in attack campaigns. In addition, new or unpublished vulnerabilities are increasingly being taken advantage of and exploited more thoroughly by cyber attack groups.
Notably, to avoid detection and prevention, APT attack groups will continue to update more complex techniques with the aim of affecting the process of detecting, investigating and analyzing malware. In addition to technical updates of malware, APT attack groups also mainly use the 'Spearphishing Attachment' method combined with fake documents as the main attack method. In addition, security vulnerabilities of popular services will also be thoroughly exploited.
“With this method, APT groups will take advantage of security vulnerabilities within a short period of time right after they are announced in cyberspace, making it almost impossible for security systems to detect,” said a Viettel Cyber Security expert.
Notably, Viettel Cyber Security also forecasts that the main targets of APT attack groups this year will continue to be banking systems; financial institutions; large enterprises, especially companies with online transaction platforms; functional agencies and key systems in the fields of national security, defense, telecommunications, energy, healthcare, education, and oil and gas.
In addition, experts also noted the possibility of cybercriminal groups applying new technologies such as AI, Machine Learning, DeepFake to upgrade the sophistication of cyber attacks. "2024 can be predicted to be a year in which many AI-generated malware, AI-supported scripted attacks, and especially video call fraud attacks using DeepFake will be discovered," said Mr. Be Khanh Duy, Head of the Southern Region Expert Services Team of VSEC Company.
Source
Comment (0)