Phishing
Trend Micro and JC3 Study on Fraud, Phishing Targeting Japanese Users
This blog details the aspects of two major phishing fraud groups identified from the research and analysis. This study was also announced via separate press releases from Trend Micro Incorporated and JC3.
Save to Folio
The Cyber Security Institute at Trend Micro, together with Japan Cybercrime Control Center (JC3) and its member organizations, has been researching and analyzing phishing fraud groups. This blog details the aspects of two major phishing fraud groups identified from the research and analysis. This study was also announced via separate press releases from Trend Micro Incorporated and JC3.
Results
One banking phishing group (named BP1 in this study) dominated all the other groups observed. BP1 uses SMS phishing to lead victims to phishing sites. Other banking phishing groups also had ties to BP1. BP1 is also the most active — operating from August 2019 up to the time of research. It also employed various disguises — from major banks, credit associations, credit card companies, mobile network carriers, to e-commerce companies.
Another phishing group, BP6, used phishing sites that are related to the XLoader Android malware. Its activities started from October 2019. BP6 was observed to have ties to BP1 as well.
Details of the study can be found in the technical brief.
How can you protect yourself from phishing?
- To avoid falling victim to phishing, fraud, and other online schemes, follow these security recommendations:
- Ensure access to online banks and other financial services through legitimate means such as through your bookmarks or its official app.
- Always check the domain name/URL on your browser before entering any of those information. Misspellings, extra letters, and characters in the domain name/URL are usually tell-tale signs of a phishing or fraudulent site.
- Having “HTTPS” on the site is no longer proof of the site’s legitimacy, as many phishing sites have been observed to use “HTTPS” to lure victims.
- Confirm that links and URLs are safe before selecting them. Use free tools such as URL safety checks from reputable threat protection services.
- For enterprises, train all employees in information security awareness. Phish Insight empowers employees by training them to know where to look, what to look at, and how to look at it. It provides the most effective phishing simulations and cybersecurity awareness training modules on the market.
- Use enterprise and home solutions that have maximum security to help thwart phishing and other threats.