Read Time1 Minute, 48 Second

Security researchers from Italian security firm TG Soft have uncovered an ongoing malware campaigns targeting Samsung service centers in Italy.

“TG Soft’s Research Centre (C.R.A.M.) has analyzed the campaign of spear-phishing on 2 april 2018 targeting the service centers of Samsung Italy.” reads the analysis published by TG Soft.

“The campaign analyzed is targeting only the service centers of Samsung Italy, it’s an attack multi-stage and we have monitored it until July 2018″

The campaign has similarities with the attacks campaigns that targeted similar electronics service centers in Russia that was discovered by Fortinet in June. The attackers’ motivation is still unclear, experts explained that the malicious code is not particularly sophisticated.

The attackers used spear-phishing emails sent to Samsung Italy service center workers. The messages have attached weaponized Excel documents.

The documents trigger the CVE-2017-11882 Office Equation Editor vulnerability to infect users.

According to a technical report published by the experts, this attack and the one against Russian service centers offering maintenance and support for various electronic goods started in the same period, in March.

While Russian service centers were hit by the Imminent Monitor RAT, the attacks on Samsung Italy service centers also involved other RATs, such Netwire and njRAT.

The quality of the spear phishing messages was high in both campaigns, they appear to have been written by a native in Italian and Russian, respectively.

The attachment used in this campaign is an Excel document titled “QRS non autorizzati.xlsx,” while the phishing messages are signed with the name of the Samsung IT Service Manager, a real employee of Samsung Italia, and includes the email and phone numbers of the employee.

At the time, the experts were not able to attribute the attack to a specific threat actor. The electronics service centers appear not particularly interesting for attackers because the volume of data it manage is little.

Probably the attackers want to compromise remote management tools used by these services in order to gain control over the computers of the customers that request support to the electronics service centers.

https://securityaffairs.co/wordpress/74518/hacking/samsung-service-centers.html