Trusted Design

New Spear Phishing Campaign Pretends to be EFF

概要

Google's security team recently identified a new domain masquerading as an official EFF site as part of a targeted malware campaign. That domain, electronicfrontierfoundation.org, is designed to trick users into a false sense of trust and it appears to have been used in a spear phishing attack, though it is unclear who the intended targets were. The domain was registered on August 4, 2015, under a presumably false name, and we suspect that the attack started on the same day. At the time of this writing the domain is still serving malware. Electronicfrontierfoundation.org was not the only domain involved in this attack. It seems to be part of a larger campaign, known as “Pawn Storm”. The current phase of the Pawn Storm attack campaign started a little over a month ago, and the overall campaign was first identified in an October 2014 report from Trend Micro (PDF). The group behind the attacks is possibly associated with the Russian government and has been active since at least 2007.

Created: 2026-02-23

Indicators

• CVE - CVE-2015-2590 -
• FileHash-MD5 - 25833224c2cb8050b90786d45f29160c -
• domain - electronicfrontierfoundation.org -
• FileHash-MD5 - 0c345969a5974e8b1ec6a5e23b2cf777 -

類似Pulses

• Uncovering the Seven Pointed Dagger (score: 0.72)
• New Attacks Linked to C0d0s0 Group (score: 0.70)
• MALWARE POSING AS HUMAN RIGHTS ORGANIZATIONS AND COMMERCIAL SOFTWARE TARGETING IRANIANS AND FOREIGN POLICY INSTITUTIONS (score: 0.67)
• Spear Phishing Campaign Using “Sign in” Themed Emails Designed to Harvest User Credentials (score: 0.65)
• Stealthy Cyberespionage Campaign Attacks With Social Engineering (score: 0.65)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る