{
  "name": "Threat actor targeting UK banks in ongoing AnyDesk social engineering campaign",
  "slug": "threat-actor-targeting-uk-banks-in-ongoing-anydesk-social-engineering-campaign",
  "description": "Threat analysts are tracking an ongoing campaign that employs fake websites and social engineering tactics to distribute a malicious version of the AnyDesk remote access software to Windows and macOS users. Once installed on a victim's machine, it is being utilized to steal data and money. The campaign primarily targets UK banks like HSBC, Natwest, Lloyds, Santander, and Virgin Money, as well as Avast, Ledger, and Wise.",
  "published": "2024-08-09T09:45:30+00:00",
  "created_at": "2024-08-09T09:45:30+00:00",
  "modified_at": "2024-08-09T10:12:21+00:00",
  "created_at_opencti": "2024-08-09T09:45:30+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-08-09",
    "anydesk",
    "phishing",
    "remote access",
    "social engineering",
    "uk banks"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "193.143.1.14"
      },
      {
        "id": "",
        "name": "91.215.85.79"
      },
      {
        "id": "",
        "name": "wisebanksupport.com"
      },
      {
        "id": "",
        "name": "wise-chatonline.com"
      },
      {
        "id": "",
        "name": "viriginmoneychatonline.com"
      },
      {
        "id": "",
        "name": "virginmoneyonlinechat.com"
      },
      {
        "id": "",
        "name": "virginmoneylivehelp.com"
      },
      {
        "id": "",
        "name": "virginmoneychatonline.com"
      },
      {
        "id": "",
        "name": "virginmoney-onlinechat.com"
      },
      {
        "id": "",
        "name": "virginmoney-help.com"
      },
      {
        "id": "",
        "name": "virginmoney-online.com"
      },
      {
        "id": "",
        "name": "virginmoney-chatonline.com"
      },
      {
        "id": "",
        "name": "virginmoney-chat.com"
      },
      {
        "id": "",
        "name": "remotesupport.help"
      },
      {
        "id": "",
        "name": "natwestonlinesupport.com"
      },
      {
        "id": "",
        "name": "natwestlivechathelp.com"
      },
      {
        "id": "",
        "name": "natwestchathelp.com"
      },
      {
        "id": "",
        "name": "natwestchat.com"
      },
      {
        "id": "",
        "name": "lloydsbankhelp.com"
      },
      {
        "id": "",
        "name": "liveapp-support.com"
      },
      {
        "id": "",
        "name": "ledgeronlinehelp.com"
      },
      {
        "id": "",
        "name": "ledgerhelpwithmydevice.com"
      },
      {
        "id": "",
        "name": "ledgerhelponline.com"
      },
      {
        "id": "",
        "name": "ledger-webapp.com"
      },
      {
        "id": "",
        "name": "hsbcliveportal.com"
      },
      {
        "id": "",
        "name": "hsbchelponline.com"
      },
      {
        "id": "",
        "name": "helpbusinessonline-boi.com"
      },
      {
        "id": "",
        "name": "hsbchelp.com"
      },
      {
        "id": "",
        "name": "ezjay-krasivo.ru"
      },
      {
        "id": "",
        "name": "cooponlinechat.com"
      },
      {
        "id": "",
        "name": "boionlinehelp.com"
      },
      {
        "id": "",
        "name": "boihelponline.com"
      },
      {
        "id": "",
        "name": "boi-support.com"
      },
      {
        "id": "",
        "name": "boi-chat.com"
      },
      {
        "id": "",
        "name": "barclayswebhelp.com"
      },
      {
        "id": "",
        "name": "barclays-online-support.com"
      },
      {
        "id": "",
        "name": "bankofirelandonlinehelp.com"
      },
      {
        "id": "",
        "name": "bankofirelandhelpportal.com"
      },
      {
        "id": "",
        "name": "avastvx.com"
      },
      {
        "id": "",
        "name": "avastsp.com"
      },
      {
        "id": "",
        "name": "avastsgp.com"
      },
      {
        "id": "",
        "name": "avastpst.com"
      },
      {
        "id": "",
        "name": "avastsf.com"
      },
      {
        "id": "",
        "name": "avastnw.com"
      },
      {
        "id": "",
        "name": "avastga.com"
      },
      {
        "id": "",
        "name": "avastcv.com"
      },
      {
        "id": "",
        "name": "avastcsw.com"
      },
      {
        "id": "",
        "name": "anz-livechatsupport.com"
      },
      {
        "id": "",
        "name": "anzsupport-livechat.com"
      },
      {
        "id": "",
        "name": "anz-help.com"
      }
    ],
    "malware": [
      {
        "id": "7193649e-f5a2-4601-8529-3e35ea193839",
        "name": "AnyDesk",
        "slug": "anydesk"
      }
    ],
    "attack_patterns": [
      {
        "id": "786b8ee9-4ff2-4c09-b393-44983ab257a0",
        "name": "T1200"
      },
      {
        "id": "ce39cd5d-9e4c-4138-b546-abd68e57f8c2",
        "name": "T1071.004"
      },
      {
        "id": "7e3e3784-9547-42ca-b888-482972d14be3",
        "name": "T1528"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "a2ba5594-6293-4868-928c-ab4b31927a02",
        "name": "T1572"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "c12e0e03-aab0-4646-a929-e921a3d27f02",
        "name": "T1219"
      },
      {
        "id": "747c7b95-79ff-4132-8ea5-397cb6665ebd",
        "name": "T1498"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://www.silentpush.com/blog/anydesk/",
    "https://otx.alienvault.com/pulse/66b6015a88b2c3482d93c9f1"
  ]
}