Google has become the latest company to fall victim to cyber criminals increasingly using artificial intelligence (AI) to bypass security measures and trick users with highly-realistic documents that install malware on networks.
This Google attack, following a similar incident targeting Microsoft SharePoint servers globally, was confirmed earlier this week.
Google, one of the so-called “Magnificent Seven” US tech companies, revealed that one of its corporate Salesforce instances was compromised by a financially-motivated threat cluster known as UNC6040.
AI is rapidly becoming hackers’ tool of choice for crafting convincing e-mails and phone calls that mimic familiar voices or sound authentically human. E-mails often include attachments that appear legitimate, prompting recipients to click and unwittingly allow malware to infiltrate networks. Meanwhile, phone calls push targets to click links sent via SMS or WhatsApp.
Richard Cassidy, Europe, Middle East and Africa chief information security officer at Rubrik, says: “We are definitely seeing these incidents become more prevalent. What’s driving this surge is a combination of rapidly-evolving AI-enabled attack tools, and the ever-expanding attack surfaces created by widespread digitalisation, without proportional investment in cyber resilience.”
The UNC6040 group targets Salesforce environments by impersonating IT support to deceive employees into installing malicious connected apps, often disguised as Salesforce’s Data Loader. This enables the attackers to covertly access networks and extract sensitive data.
Quick response
In the most recent attack, Google said it “responded to the activity, performed an impact analysis and began mitigations”. The breach affected systems storing contact information and related notes for small and medium businesses.
“Analysis revealed that data was retrieved by the threat actor during a small window before access was cut off. The data retrieved was confined to basic and largely publicly available business information, such as business names and contact details,” Google said.
Google also reported that the extortion involved calls or e-mails to victim organisation employees demanding Bitcoin payments within 72 hours. During these communications, the threat actors have consistently claimed to be the group known as ShinyHunters.
Large-scale attacks
SentinelLABS and Beazley Security recently uncovered and analysed a rapidly-evolving series of infostealer campaigns delivering the Python-based PXA Stealer. This malware uses Telegram bots to sell stolen data in a manner that is nearly undetectable.
The actors, reportedly Vietnamese hackers, have compromised more than 4 000 unique victim IP addresses across at least 62 countries, including South Korea, the United States, the Netherlands, Hungary and Austria.
