Swiss Post CERT

Thanks Corsin .@cocaman & Andre .@AndreGironda for great sharing on @abuse_ch Bazaar, ThreatFox & URLhaus! This is a rather interesting #AsyncRAT campaign. Spoofing @swisspost & @USPS as sender CC: @SwissPost_CERT & @OIGUSPS 🧵 1/ #MalwareChallenge

@cynicalsecurity @swisspost Thanks for letting us know. 👍 Contacted via DM to get more details. ^tu

@swisspost @SwissPost_CERT Don't speak German… Italian or French or English or Spanish.

How does one enter the following numerical authentication code (received via SMS from @swisspost)? #golfclap #SecurityTheatre

Be aware of current patterns of fraud: Swiss Post does not process payments via post[.]ch[.]paysget[.]info. Find out more ⬇️ post.ch/en/pages/foote…

@mylaocoon Besten Dank Candid für die Meldung! Wir kümmern uns um die Phishing Domains.

Die üblichen Swiss Post #phishing Mails - dabei verpasse ich doch keine Lieferung im Homeoffice 🤣 Bitte Löschen und keine Daten eingeben https://teatch-swiss.blogspot[.]com https://w-swiss-post-ch[.]net/home_paie/ @SwissPost_CERT

@FrPhishing @abuse_ch Thanks for your notification. Takedown process has been initiated 2021-01-26 18:17 CET, and escalated again today.

Quasiment le même qu'en début de semaine #phishing #laposte #swisspost cc @abuse_ch @SwissPost_CERT ► service-client-suivi[.]com

@mylaocoon Late thanks for the headsup. Notified roughly 200 phishing sites this month mimicking Swiss Post.

Es muss bald Weihnachten sein sie „Post“ Phishing Mails nehmen zu. Immernoch CHF 2.99😂 aber die Scam Seite ist besser geworden Aber Wieso ist de Empfänger „Die Post“ ich dachte sei mein Paket🤔 @SwissPost_CERT #scam #phishing

abuse.ch: Time to move forward. Your help is needed ⛑️ 👉 abuse.ch/blog/moving-fo…

@ninoseki Thanks as always for the notification / mention! We also just found this blog (in German), but not sure if it's the same sample or malware. No real IOCs, but nice screenshots and earlier waves (from Aug & May 2020) linked at the bottom as well. cybercrimepolice.ch/de/fall/dritte…

#XiGhost is now impersonating Die Post. virustotal.com/gui/ip-address… apklab.io/apk.html?hash=… FYI @SwissPost_CERT

@akulhanek Danke für die Meldung! (und auch noch ans CERT Team 👍) Wir versuchen laufend solche Phishing Seiten schnell vom Netz nehmen zu können.

Wieder einmal ein gut gemachtes Phishing-Mail... @SwissPost_CERT @postschweiz #phishing

@s_metanka @ninoseki Thanks both for the information! Yes, looks like ES & CU targeting also.

@ninoseki @SwissPost_CERT Are these new targets maybe? Spain and Cuba: https://post-nord .top/es/ and https://post-nord .top/cu/

Strangely a #XiGhost host which impersonates Die Post (Swiss Post) drops Correos.apk. urlscan.io/domain/die-6.t… virustotal.com/gui/file/634cf… FYI @SwissPost_CERT

@ninoseki Thank you @ninoseki for the heads-up!

Indonesian scammers are impersonating Swiss Post. hxxps://thebarbeeston[.]co[.]uk/includes/swiss[.]zip FYI @SwissPost_CERT

New blog: This year the cybercrime group #RoamingMantis has been actively targeting the European users of both #iOS and #Android devices. This post provides an insight into the rate of success in their recent advancements. medium.com/csis-techblog/… #Malware #Phishing @csis_cyber

@ninoseki @cybereason @CyberCSIS We're always interested to find out more about #FakeSpy campaigns involving @SwissPost impersonations. Please mention @SwissPost_CERT to notify us.

I believe #RoamingMantis is a name of a campaign (which is named by Kaspersky GReAT). It is not a group. But recently I saw some reports which use #RoamingMantis as a name of a group. e.g. cybereason.com/blog/fakespy-m… (by @cybereason) medium.com/csis-techblog/… (by @CyberCSIS)

CSIS researcher (and past VB conference speaker) @s_metanka looked at how the RoamingMantis Android malware is now targeting European countries too and how the same group is engaging in Apple ID phishing medium.com/csis-techblog/…

@papa_anniekey Thanks for the hint! We believe there likely is a connection. There is some great and interesting info in this #RoamingMantis presentation from @BotConf 2019 botconf.eu/wp-content/upl…

#Roamingmantis ?

cybercrimepolice: "Angebliche Paketlieferung mit Code per SMS freischalten" cybercrimepolice.ch/de/fall/angebl… #phishing #betrug

Betrüger geben sich als @postschweiz aus und versuchen Spionage App zu verteilen… bit.ly/2WKvuyL #sicherheit #malware #phishing #malware

@midnight_comms Thanks for the heads-up! I will take this up with @SwissPost_CERT We've been seeing an uptick of #FakeSpy Android Malware recently.

Vorsicht vor gefälschten E-Mails im Namen der Eidgenössischen Steuerverwaltung ESTV: Beim Excel Anhang handelt es sich um Schadsoftware #guloader. Nicht öffnen!