Targetted Phishing Emails aimed at JP Morgan Customers - Specific details on the mailing list serve

Earlier today we put out some information on some targeted phishing we have been seeing on our network sensors and some mail servers in which we have access to logs.

It seems this is an ongoing issue since at least the 18th of March.

Additional Information:
http://sanesecurity.blogspot.com/2015/03/jp-morgan-access-secure-message-Elwood-Ritter.html

Malware: tinba is gonna be the end of Suntrust, Regions Bank and a few others... wait for it! (Dyre Banking Trojan) - Updated

If your monitoring infections and malware traffic it goes without saying that banking targets are high on the priority watch list. I'm making this prediction based on intelligence that we are seeing in the SOC. Let's see how this plays out.

My prediction is that the following banks are gonna get nailed by tinba:

1.Suntrust

2. Regions Bank

3. Credit One Bank

4. Netteller

5. TD Bank

6. JP Morgan Chase

7. PNC Bank

8. RBC Bank

Since this campaign is targeting customers there is little that the banks can do to stop it. Most of the issue is being caused by anonymous proxies and some very interesting MITM traffic.