{"id":41225,"date":"2021-06-04T13:00:00","date_gmt":"2021-06-04T13:00:00","guid":{"rendered":"http:\/\/7228207b-47e3-4b37-82d7-9f1d1786e2d0"},"modified":"2021-06-04T13:00:00","modified_gmt":"2021-06-04T13:00:00","slug":"hackers-use-colonial-pipeline-ransomware-news-for-phishing-attack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hackers-use-colonial-pipeline-ransomware-news-for-phishing-attack\/","title":{"rendered":"Hackers use Colonial pipeline ransomware news for phishing attack"},"content":{"rendered":"

Cyberattackers are now using the notoriety of the Colonial Pipeline<\/a> ransomware attack to leverage further phishing attacks<\/a>, according to the findings of a cybersecurity company. <\/p>\n

It is common for attackers to use widely-covered news events to get people to click on malicious emails and links, and cybersecurity firm INKY said it recently received multiple helpdesk emails about curious emails their customers were receiving. <\/p>\n

INKY customers reported receiving emails that discuss the ransomware attack on Colonial Pipeline and ask them to download “ransomware system updates” in order to protect their organization from a similar fate. <\/p>\n

The malicious links take users to websites with convincing names — ms-sysupdate.com and selectivepatch.com — both of which are newly created and registered with NameCheap. The same domain that sent the emails also controlled the links, INKY explained in a blog post. <\/p>\n

\"help-desk.jpg\"<\/span>