{"id":295008,"date":"2019-02-06T12:34:01","date_gmt":"2019-02-06T10:34:01","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=295008"},"modified":"2019-02-06T12:36:41","modified_gmt":"2019-02-06T10:36:41","slug":"hacker-warns-eskom-about-malware-that-stole-a-users-company-credentials","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/295008-hacker-warns-eskom-about-malware-that-stole-a-users-company-credentials.html","title":{"rendered":"Hacker warns Eskom about malware that stole a user’s company credentials"},"content":{"rendered":"

A hacker from the MalwareMustDie<\/a><\/strong> security research work group reached out to Eskom on Twitter today to warn the utility that a user had installed malware on their machine.<\/p>\n

According to the researchers, an Eskom employee with the username \u201cmg@eskom.co.za\u201d installed a trojan on their machine after downloading a fake Sims 4 installer.<\/p>\n

All of the person\u2019s credentials were stolen, including their company credentials, the hacker warned.<\/p>\n

Initially Eskom disputed the accuracy of the hacker\u2019s claims, stating that the username provided is not one used on its network. The utility has since deleted this tweet.<\/p>\n

In response, the hacker posted more details relating to the compromised user, including their name, additional usernames, and a screenshot of the person\u2019s desktop.<\/p>\n

A search for the person\u2019s name on LinkedIn showed two profiles for people working at Eskom: a technical advisor, and a senior infrastructure advisor.<\/p>\n

The national spokesperson for Eskom, Khulu Phasiwe\u200b, told MyBroadband that the utility\u2019s head of information technology is aware of the issue and that the IT team is investigating.<\/p>\n

Eskom subsequently responded<\/a><\/strong> to the hacker on Twitter:<\/p>\n

This has been investigated and the necessary actions have been taken. Thank you for bringing it to our attention.<\/p><\/blockquote>\n

\"Eskom<\/a><\/p>\n

\n

Dear @Eskom_SA<\/a> . Please investigate on your user "mg@eskom.co.za". There is a trojan on here machine. All her credentials were stolen. (Including here company credentials)
Malware location: "C:ProgramDataGentlesMusiccert.exe"
Computer: DESKTOP-6T3OPUK#malwaremustdie<\/a> #malware<\/a><\/p>\n

— .sS.! (@sS55752750) February 4, 2019<\/a><\/p><\/blockquote>\n