Live
- India Faces Blow as Pacer Mohammed Shami Ruled Out for Remainder of Australia Series
- Biden Pardon: Joe Biden Commutes Death Sentences of 37 Inmates, Including Child Killers and Mass Murderers
- South Korea: Yoon believes impeachment trial takes priority over martial law probe
- Strict Action for Non-Adherence to Time Management - DMHO Dr. Swarajya Lakshmi
- Over 13.29 lakh houses approved for rural poor in Maharashtra: Shivraj Chouhan
- District Collector Urges Timely Completion of Indiramma Housing Scheme Survey
- Digital Arrest Scam: Hyderabad Man Duped of ₹7 Lakhs by Fake Crime Branch Police Callers
- Sukhbir Badal seeks President's Police medal for officer who saved his life
- US Firm Accordion Acquires Merilytics, Launches 1,500-Seater Office in Hyderabad
- Free Medical Camp Organized by Alampur Advocate Bar Association
Google sent 50,000 warnings to users on govt-back hackings
Google sent 50,000 warnings to users on govt-back hackings
Google has said that so far in 2021, it has sent over 50,000 warnings to those whose accounts were the target of government-backed phishing or malware attempts, a nearly 33 per cent increase from this time in 2020
San Francisco: Google has said that so far in 2021, it has sent over 50,000 warnings to those whose accounts were the target of government-backed phishing or malware attempts, a nearly 33 per cent increase from this time in 2020.
The company said that it intentionally sends these warnings in batches to all users who may be at risk, rather than the moment the company detects the threat itself so that attackers cannot track defence strategies.
"On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries. This means that there is typically more than one threat actor behind the warnings," the company said in a blogpost.
The blogpost mentioned that some of the most notable campaigns the company disrupted this year from a different government-backed attacker -- APT35 -- an Iranian group, which regularly conducts phishing campaigns targeting high-risk users.
For years, this group has hijacked accounts, deployed malware and used novel techniques to conduct espionage aligned with the interests of the Iranian government, the company said.
In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit. Attackers sent email messages with links to this website to harvest credentials for platforms such as Gmail, Hotmail and Yahoo.
Users were instructed to activate an invitation to a (fake) webinar by logging in. The phishing kit will also ask for second-factor authentication codes sent to devices.
APT35 has relied on this technique since 2017 -- targeting high-value accounts in government, academia, journalism, NGOs, foreign policy aand national security.
Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate -- as they know it's difficult for users to detect this kind of attack.
Last year in May, Google discovered that APT35 attempted to upload spyware to the Google Play Store.
The app was disguised as VPN software that, if installed, could steal sensitive information such as call logs, text messages, contacts and location data from devices.
Google detected the app quickly and removed it from the Play Store before any users had a chance to install it.
