‘Get rich or die trying’ – Check Point Researchers Uncover International Cyber Attack Campaign

A Nigerian national based near the country’s capital masterminded a wave of attacks on over 4,000 companies in oil & gas, mining, construction and transportation sectors.

San Carlos, CA  —  Tue, 15 Aug 2017

Check Point® Software Technologies Ltd. (NASDAQ: CHKP) has today revealed the identity of the criminal behind a series of what appeared to be state-sponsored cyberattacks targeting over 4,000 companies in the energy, mining and infrastructure sectors.

The campaign started in April 2017, and has targeted some of the largest international organisations in the oil & gas, manufacturing, banking and construction industries.  The global scale of the campaign and the organisations targeted suggest an expert gang or state-sponsored agency is behind it:  but the campaign is the work of a lone Nigerian national in his mid-20s, living near the country’s capital.  On his Facebook account, he uses the motto:  ‘get rich or die trying’.

His attack campaign used fraudulent emails which appear to originate from oil and gas giant Saudi Aramco, the world’s second largest daily oil producer, targeting financial staff within companies to trick them into revealing company bank details, or open the email’s malware-infected attachment.

He used NetWire, a remote access Trojan which allows full control over infected machines, and Hawkeye, a keylogging program.  The campaign has resulted in 14 successful infections, earning the criminal thousands of dollars in the process.

Maya Horowitz, Threat Intelligence Group Manager for Check Point said:  “Even though this individual is using low-quality phishing emails, and generic malware which is easy to find online, his campaign has still been able to infect several organisations and target thousands more worldwide.  It shows just how easy it is for a relatively unskilled hacker to launch a large-scale campaign that successfully breaches the defenses of even large companies, enabling them to commit fraud.”

“This emphasises the need for organisations to improve their security to protect against phishing or business email compromise scams, and to educate employees to be cautious about opening emails, even from companies or individuals that they recognise.”

Since uncovering the campaign and establishing its origins, Check Point’s research team has notified law enforcement authorities in Nigeria and internationally and shared its findings with them.

Business Email Compromise (BEC) attacks have increased dramatically over the past 18 months.  The FBI reported a 270% increase in victims since the start of 2016, costing organisations globally over US $3 billion from 2013 to 2016, and estimates that BEC victims lose $50,000 on average.

The Check Point Anti-Spam & Email Security Software Blade protects customers from falling victim to such scams. Its multidimensional approach protects email infrastructure, provides highly accurate anti-spam coverage, and defends organisations from a wide variety of virus and malware threats delivered by email.  In addition, SandBlast™ Agent with Zero Phishing™ technology protects organisations from new and unknown phishing sites, as well as from threats contained in documents and links within emails.

For more information about the techniques used by the individual to target organisations, visit: https://blog.checkpoint.com/2017/08/15/get-rich-die-trying-case-study-real-identity-behind-wave-cyberattacks-energy-mining-infrastructure-companies/

Follow Check Point via:

Check Point Blog: https://blog.checkpoint.com/

Twitter: https://www.twitter.com/checkpointsw

Facebook: https://www.facebook.com/checkpointsoftware

YouTube: https://www.youtube.com/user/CPGlobal

LinkedIn: https://www.linkedin.com/company/check-point-software-technologies

About Check Point Software Technologies Ltd.

Check Point Software Technologies Ltd. (www.checkpoint.com) is the largest network cyber security vendor globally, providing industry-leading solutions and protecting customers from cyberattacks with an unmatched catch rate of malware and other types of threats. Check Point offers a complete security architecture defending enterprises – from networks to mobile devices – in addition to the most comprehensive and intuitive security management. Check Point protects over 100,000 organisations of all sizes.