Home Page

4 days ago

Uptick in Fraudulent Unemployment Insurance Claims

The NJCCIC received reports of an uptick in fraudulent New Jersey Department of Labor and Workforce Development Unemployment Insurance (UI) claims, primarily targeting public sector education employees who are still employed. The availability of employee information posted on official websites or social media platforms, combined with personally identifiable information (PII) exposed in past data breaches or sold on the dark web, enables threat actors to apply for and collect UI benefits illegally.

Victims may not be aware that fraudulent UI benefits applications are being attempted under their name until they try to apply for UI benefits and are denied or rejected because a claim has already been filed under their name, or they receive a determination letter indicating that an application has been received under their name, but they did not apply for UI benefits. Additionally, a current or former employer may notify the victim that a claim has been submitted with their PII.

Recommendations

• Reduce your digital footprint so threat actors cannot easily target you.
• If PII compromise is suspected or detected, contact your local law enforcement department and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources.
• Suspected unemployment insurance fraud can be reported to the New Jersey Department of Labor and Workforce Development via their Report Fraud online form or by phone at 609-777-4304.
• Report malicious cyber activity to the NJCCIC, the FBI's IC3, and the FTC.
.

Phishing Campaign Impersonates Social Security Administration

The NJCCIC identified a phishing campaign impersonating the Social Security Administration. The email notifies the user that their "Social Security Statement" is available online and instructs them to click the included link to access the statement.

This link leads to a webpage, hxxp://getssafile[.]help/sxa/, that displays stolen Social Security Administration branding and instructs users to download an executable file to view instructions.

The executable attempts to download a remote monitoring and management tool, which cyber threat actors can use to gain unauthorized access and take control over systems to install additional malware, access sensitive information, deploy ransomware, and more. Known, trusted organizations are often impersonated by cyber threat actors in social engineering schemes to convince users to take actions that enable the threat actor's ultimate goals.

Recommendations

• Verify communications before clicking links delivered in emails. Government communications will be sent from official email accounts, and the included links will direct users to government websites.
• Log in to official account websites or apps to access documents or statements.
• Do not download files from unofficial or unverified sources.
• Run an updated, reputable anti-malware program on all devices.
• Report suspected phishing communications to the impersonated agency, the NJCCIC, and the FBI's IC3.
.

Calendaromatic Malware

The NJCCIC received reports of the Calendaromatic malware affecting multiple New Jersey public sector organizations, including local and county government entities. Calendaromatic malware is a potentially unwanted application (PUA) primarily targeting entities in the United States. It is disguised as a benign calendar desktop application designed to manage holiday schedules. Threat actors behind the Calendaromatic malware employ an aggressive and sophisticated online advertising campaign, leveraging NeutralinoJS, Unicode homoglyphs, and hidden payloads to evade detection, gain initial access, maintain persistence, and exfiltrate data.

Threat actors target potential victims with Calendaromatic malware by luring them to third-party websites with advanced holiday planning tools. The “calendaromatic” executable file is a 7z self-extracting archive setup file. Although it is signed with a valid digital certificate by CROWN SKY LLC, the certificate has since been revoked. If extracted and installed, the victims grant the seemingly benign calendar tool permission to interact directly with the operating system. The malware establishes a hidden command and control (C2) channel within Unicode holiday names and executes covert operations against the host operating system. The app’s “clean()” function checks for look-alike characters to tidy up holiday data, reads and decodes secret instructions, and executes commands on the host.

Artificial intelligence (AI) accelerated the investigation and forensic process by parsing the obfuscated JavaScript and highlighting anomalous code sequences for Unicode character mapping. The AI tools traced the “clean()” function logic and revealed how the malware parsed and executed instructions embedded within holiday data.

Recommendations

• Exercise caution when downloading and installing unfamiliar or untrusted applications from web searches.
• Refrain from installing unsigned or unverified software.
• Reset passwords on any compromised hosts, including credentials stored in browsers.
• Keep systems, browsers, and anti-virus/anti-malware software up to date with PUA detection enabled.
• Restore affected systems from backup or perform a complete operating system reinstallation.
• Review the GuidePoint Security blog post for technical information and indicators of compromise (IOCs).
• Report malicious cyber activity to the NJCCIC and the FBI's IC3.
.

These Emails Are Best Left in Quarantine

The NJCCIC has observed a phishing campaign posing as an automated notification about quarantined emails. Many companies employ email security protection, which often includes a quarantine feature that holds potentially risky emails for user review.

If a user clicks on one of the provided links, a CAPTCHA page will load, requiring the user to verify before they can proceed. These pages are often utilized in phishing scams because they can prevent email security systems from detecting the malicious nature of the emails.

Once verified, a page that appears to be a legitimate Microsoft login page loads; however, the URL is a warning sign that this is not a genuine Microsoft page. Any credentials entered will be harvested through synchronous relay capabilities, a technique known as an Adversary-in-the-Middle (AiTM) attack. Associated session cookies will also be collected. Researchers have discovered that the threat actor behind this campaign is using the ODx Phishing-as-a-Service (PhaaS) kit, also tracked as Storm-1167.

Finally, the target will receive a request for approval from the Microsoft Authenticator. Although the request may seem legitimate, approving it will grant the threat actors access to the target’s account.

Recommendations

• Avoid clicking links and opening attachments in unsolicited emails.
• Confirm requests from senders via contact information obtained from verified and official sources.
• Users should only submit account credentials on official websites.
• Maintain robust and up-to-date endpoint detection tools on every endpoint.
• Consider leveraging behavior-based detection tools rather than signature-based tools.
• If you suspect an account has been compromised, change the account's password immediately and add a secondary authentication method.
• Report other malicious cyber activity to the NJCCIC and the FBI's IC3.
Announcements

CISA Strengthens Commitment to SLTT Governments

NIST: Guidelines for Media Sanitization

NIST: Recommendation for Random Bit Generator (RBG) Constructions

Check Point: The Manufacturing Security Report 2025

INTERPOL: 260 Suspected Scammers Arrested in Pan-African Cybercrime Operation

Threat and Vulnerability Advisories

MS-ISAC Advisories

CISA Cybersecurity Alerts & Advisories

CISA Known Exploited Vulnerabilities Catalog

CISA Secure by Design Alerts

CISA Shields UP

Breach Notifications

Allianz Life Insurance Company
Allianz Life Insurance Company disclosed a data breach impacting approximately 1.4 million customers, financial professionals, and select Allianz Life employees. The security incident that occured on July 16 was limited to a third-party cloud-based customer relationship management (CRM) system. The breach was contained and mitigated. Stolen personal information includes names, addresses, dates of birth, and Social Security numbers. Allianz Life notified impacted individuals and provided two years of free identity theft and credit monitoring services. The NJCCIC recommends that affected individuals review the Compromised PII and Identity Theft NJCCIC Informational Report.

Motility Software Solutions
Motility Software Solutions, a provider of dealer management software (DMS), detected unusual activity within specific computer servers supporting business operations around August 19. An unauthorized threat actor deployed malware that encrypted some systems, restricting access to internal data. Approximately 766,000 customers may have had their information exposed, including full name, portal address, email address, telephone number, date of birth, Social Security number, and driver’s license number. Motility is providing one year of free identity monitoring services to impacted individuals. The NJCCIC recommends that affected individuals review the Compromised PII and Identity Theft NJCCIC Informational Report.

.

. ... See MoreSee Less

DWI Arrest

Drug Arrest

Drug Arrest

Burglary and Theft Arrests

Drug Arrest

DWI and Drug Arrest