A phishing campaign that spreads a remote access trojan called Hupigon, a RAT that was first identified in 2010, is targeting higher education institutions in the United States.

The Hupigon RAT has previously been deployed by advanced persistent threat groups (APT) from China, although this campaign is not thought to have been operated by APT groups, instead the Hupigon RAT has been repurposed by hackers. While many industries have been targeted in the campaign, almost half of attacks have been conducted on colleges and universities.

The Hupigon RAT allows the operators to install other malware variants, steal passwords, and obtain access to the microphone and webcam. Infection could see the hackers take full management of an infected device.

The campaign uses online dating lures to trick users to install the Trojan. The emails show two dating profiles of supposed users of the platform, and the recipient is directed to select the one they find the most attractive. When the user makes their choice, they are brought to a website where an executable file is downloaded, which installs the Hupigon RAT.

The choice of lure for the campaign is no doubt influenced by the huge increase in popularity of dating apps during the COVID-19 pandemic. While there are not many actual dates taking place due to lockdown and social distancing measures now in place around the world, the lockdowns have seen many people with a lot of time on their hands. That, coupled with social isolation for many single people, has actually led to a rise in the use of online dating apps, with many users of the apps turning to Zoom and FaceTime to have virtual dates. Many popular dating apps have reported a rise in use during the COVID-19 pandemic. For instance, Tinder reports use has grown, with the platform having its busiest ever day, with over 3 billion profiles swiped in just one day.

As we have already seen with COVID-19 tricks in phishing attacks, which account for most lures during the pandemic, when there is interest in a particular event or news story, hackers will take advantage. With the popularity of dating apps surging, we can expect to see an rise in the number of online dating -themed lures.

The advice for higher education institutions and companies is to ensure that an advanced spam filtering solution is in place to prevent the malicious messages and ensure they do not land in end users’ inboxes. It is also crucial to ensure that security awareness training is still being conducted for staff, students, and remote employees to teach them how to spot the signs of phishing and other email threats.

TitanHQ can be os assistance. If you wish to better protect staff, students, and employees and keep inboxes free of threats, give the TitanHQ team a call as soon as you can. After registering, you can be protecting your inboxes in no time.