Re:A fake job offer took down Axie Infinity
by samstave on Wednesday July 06, 2022 @01:53PM
(#32004448)
Speaking of spear phishing:
When I was at lockheed we had an incident whereby a bunch of folks had attended some defense conference, and after the fact received emails from folks they had 'met' at the conference, something along the lines of
"Hey Bob, we met at the [defense] conference this last week and I wanted to be sure you had my contact info: malware-contact.vcf"
or some other payload.
This installed a very slow sprawling worm which would slowly trickle data out of lockheed to China.
It was not discovered for quite a while due to how slowly it operated, but someone had complained about machine performance and IT looked at the machine and discovered the worm... after removing it - this somehow sent a signal to China that they had been found and all the worms started to firehose as much as they could until egress was closed. At the time, all of Lockheeds 150,000 employees had just three egress points to the internet. They had to shut them all down to kill that worm.
When I was at lockheed we had an incident whereby a bunch of folks had attended some defense conference, and after the fact received emails from folks they had 'met' at the conference, something along the lines of
"Hey Bob, we met at the [defense] conference this last week and I wanted to be sure you had my contact info: malware-contact.vcf"
or some other payload.
This installed a very slow sprawling worm which would slowly trickle data out of lockheed to China.
It was not discovered for quite a while due to how slowly it operated, but someone had complained about machine performance and IT looked at the machine and discovered the worm... after removing it - this somehow sent a signal to China that they had been found and all the worms started to firehose as much as they could until egress was closed. At the time, all of Lockheeds 150,000 employees had just three egress points to the internet. They had to shut them all down to kill that worm.