Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
A new type of cyber-attack is currently spreading like wildfire in the Nordics, targeting email addresses indiscriminate of user profiles (i.e., small office/home user, home user, mobile user, power user, and large business user). Earmarked the National Danish Police phishing attack after the email that would accompany the full incident disclosure, this type of cyber-aggression employs a combination of social engineering and scare tactics in order to coax the user into replying to the mail and complying with the aggressor’s instructions. In all instances, the user would be faced with an email – most likely sent to a personal address – that contains a few lines regarding the nature of the summoning and a single pdf enclosed to the email that, purportedly, details the legal implications of his Internet activity.
The Facts on the Case of the Case of the National Danish Police Phishing Attack
On the 29th of August, Heimdal®’s SOC team received an anonymous tip about an active phishing attempt. These are the facts in the case of the newly discovered phishing attempt. The email received from our anonymous source carried an informative note about an ongoing criminal investigation implicating the email’s recipient. A preliminary investigation performed on the email’s body revealed no clues about the aggressor’s identity, motivation, or intentions – the message is cryptic, redacted in a bright red font, with uppercase letters.
No URLs have been found in the email’s body or other forms of tempering. The only discrepancy we have uncovered, at this point, was between the sender’s field and the signature footer. According to the former, the email was sent from a Danish TLD (i.e., t-online.de) associated with a work email address of one Wilhelm Spielmann, allegedly a member of the Danish General Court. However, the email’s footer contains the name of Lars Boje Nielsen, Denmark’s acting Police Director of the National Unit for Special Crime compartment. Translated from Danish to English, the message reads.
ATTENTION:
ATTACHED FILE IS THE POLICE SUMMONS LETTER. DOWNLOAD THE ATTACHED FILE TO READ THE MESSAGE AND REPLY BACK IMMEDIATELY.
LASSE BOJE NIELSEN
DIRECTOR OF POLICE, NATIONAL SPECIAL CRIME UNIT.
The original message can be found below.
During the second phase of our investigation, we analyzed the email’s .pdf attachment in a sandbox-type environment. The document’s metadata revealed very little information – politet rapport.DK.pdf was created on the 16th of July 2023 with iTextSharp™ 5.5.13© 2000-2018 iText Group NV (AGPL-version), version 1.4 of Acrobat 5. x, and with a file size of 936 KB. No information about the title, author, subject, or keywords has been enclosed. The timestamp suggests that the document has had no modifications since its creation date. Some security features were added to the pdf:
- Printing: Allowed.
- Document Assembly: Not Allowed. (i.e., metadata or document itself might be password-protected).
- Content Copying: Allowed.
- Content Copying for Accessibility: Allowed.
- Page Extraction: Not Allowed. (i.e., for security purposes, the recipient isn’t allowed to make any changes to the document).
- Commenting: Allowed.
- Filling of form fields: Allowed.
- Signing: Allowed.
- Creation of Template Pages: Allowed.
During our third phase of the investigation, we analyzed the document in depth for malicious elements. Our examination concluded that no such elements are found in the politet rapport.DK pdf document. The sample tested negative for hidden URLs, malicious scripting, steganography, or other forms of triggers based on user interaction.
On-page elements appear to be consistent with this type of electronic documentation – the Greater (royal) Danish coats of arms found on the upper left side of the document are undifferentiated when compared with the official version, as is the Rigspolitiet Politi (i.e., Danish National Police) navy-blue logo in the upper-right corner of the document.
In regards to the pdf content, the note accompanying the email reads the following (i.e., for accessibility purposes, the note has been translated into English).
SUMMONS
For the purpose of a legal investigation (Article 390-1 of the Criminal Procedure Act)
We, Lasse Boje Nielsen, police director of the National Unit for Special Crime under the Directorate for Combating Crime and Cybercrime in collaboration with Europol. In continuation of the preliminary investigation no. P 09 341 9205/4, we submit a summons to international justice according to instructions from the public prosecutor (L. no. 2019-222 of 23 March 2019, art. 47 of the Criminal Code.)
We commit to you, according to Article 75 of the Code of Criminal Procedure, proceedings shortly after a computer seizure by our National Center for the Analysis of Images of Child Pornography and Exhibitionist (CNAIPE) whose mission is to identify victims and authors of content of child pornography and exhibitionism.
The facts are as follows: CHILD PORNOGRAPHY, PORNOGRAPHIC SITE, CYBER PORNOGRAPHY AND EXHIBITION.
These are acts that are punishable by law as set out in Article 222-32 of the Penal Code, which states that “Sexual exhibition imposed in front of others in a publicly accessible place is punishable by one year in prison and a fine of €15,000” and in according to article 227-23 of the Penal Code “The fact, for the purpose of dissemination, Determination, recording or transmission of an image or representation of a minor, when the image or representation is pornographic, is punishable by five years in prison and a fine of € 75,000.
If the image or reproduction concerns a minor under the age of fifteen, such acts are punishable, even if they are not committed with the aim of disseminating the image or image in question.” Additional sanctions may be imposed (according to articles 222-44 and 222 of the Criminal Code -45), e.g. prohibition of certain types of commercial activities. with reference to article 197-11, in force on 1 October 2004. You are advised to attend the hearing with attachments and your income as well as your tax or non- tax transactions.
Now that your laws and offenses are laid before you. We hope you will understand the reason for this summons. I look forward to your reply as soon as possible and your reasons. We will follow this topic very soon.
Promote an immediate response after this notice to avoid binding disputes. Our server is sometimes down, sorry if our email is spam!
LASSE BOJE NIELSEN:
Police Director, National Unit for Special Crime.
POLICE
Europol is the intergovernmental body that, within the EU, facilitates the exchange of information between national police forces in the fields of narcotics, terrorism, international crime, and pedophilia. Europol has been operational since 1999 and since 2010 has been a European agency funded by the Community budget and therefore controlled by the European Parliament.
The original text can be found below.
Summary of document
- The document has allegedly been sent (and signed) by Lasse Boje Nielsen, Police Director of the National Unit for Special Crime under the Directorate for Combating Crime and Cybercrime.
- The document has been transmitted following a fictitious computer seizure, allegedly orchestrated by the National Center for the Analysis of Images of Child Pornography and Exhibitionist (CNAIPE).
- A preliminary investigation, bearing the number P 09 341 9205/4 (i.e., fake), has been started against the user.
- A public prosecutor has issued the summoning letter bearing the number L. no. 2019-222 of 23 March 2019, art. 47 of the Criminal Code.
- Scare TTPs: citing Article 222-32 of the Penal Code, which states that “Sexual exhibition imposed in front of others in a publicly accessible place is punishable by one year in prison and a fine of €15,000” and in according to article 227-23 of the Penal Code “The fact, for the purpose of dissemination, Determination, recording or transmission of an image or representation of a minor, when the image or representation is pornographic, is punishable by five years in prison and a fine of € 75,000.”
- Counts: CHILD PORNOGRAPHY, PORNOGRAPHIC SITE, CYBER PORNOGRAPHY AND EXHIBITION.
- Additional directives: Upon receiving this notice, the user, under duress (i.e., binding notice) must reply as soon as possible in order to receive supplementary instructions.
Conclusions
Based on the available data, we have concluded the following
- Under the guise of a forged identity, an unknown APT has crafted a pdf document and a cryptic mail, with no traceable elements, and employed both in order to carry out phishing attacks against home users and HVTs.
- The APT’s social engineering tactics revolve around the user’s online behavior and activity. Text-based evidence implies that the victim, at some point in time, might have deviated from normal, societally accepted online browsing behavior, dawdling in illicit activities such as infantile pornography.
- Actions on object are strongly dependent on the psychological factor. Considering that neither the email body nor the attached PDF document contains additional malicious elements (e.g., scripting, hidden URLs, steganography, etc.), the attack’s success rate rests solely on user interaction. However, taking into account that the document bears official government markings and specific phrasing, there’s a high chance that a less cyber-literate user could comply with the APT’s requests.
- Unknown post-interaction trajectory. Due to the fact that no victims have been reported, we can only conclude that the phishing campaign’s end goal remains unknown. Based on previously documented occurrences such as the Police Ransomware, Metropolitan British Police Ransomware, Romanian Police Virus, Greater London Police Virus, Australian Federal Police Virus, Cuerpo Nacional de Policia Virus, etc., we can hypothesize that, upon replying to the fraudulent email, the user would receive an additional email containing a payment form or instructions on how to make financial reparations in order to avoid prosecution.
Anti-phishing Cybersecurity Tips
Below, you will find a short list of tips on how to guard yourself against phishing attempts.
Avoid opening suspicious-looking emails
Be mindful when opening emails outside your email list. Look for anything out of the ordinary such as grammatical inconsistencies, typos, peculiar graphical elements, and, of course, attachments.
Deploy and employ next-gen anti-phishing protection
Some phishing attempts, such as the one we’ve discussed, employ a sophisticated anti-detection mechanism, allowing them to get past your antivirus. To counter these threats, you use an anti-malware solution that looks beyond the ‘file’ and ‘code’ levels.
Heimdal® DNS Security – Endpoint, Heimdal®’s award-winning network-facing DNS-filtering solution, can prevent threats from reaching your machine by blocking traffic to and from any malicious C&C server.
Wrap-up
The National Danish Police Phishing Attack is still active but, fortunately, no victims have been identified. Heimdal®’s evidence suggests that this attack makes no discrimination between home and corporate users. The tell-tale signs associated with this phishing attempt are as follows – the “land” email written in red uppercase letters, the .pdf attachment signed by Lasse Boje Nielsen, Police Director, National Unit for Special Crime under the Directorate for Combating Crime and Cybercrime, and the child pornography allegations.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, and YouTube, for more cybersecurity news and topics.
