New campaign uses government, union-themed lures to deliver Cobalt Strike beacons
Summary: Cisco Talos discovered a phishing campaign that delivers Cobalt Strike beacons through malicious Word documents exploiting CVE-2017-0199, which download remote DOTM templates hosted on attacker-controlled Bitbucket accounts 'atlasover' and 'clouchfair'. The lures mimic a U.S. Office of Personnel Management declaration form collecting PII from job applicants and a New Zealand Public Service Association job description dated May 6, 2022, with the final beacon performing targeted process injection and using a high-reputation domain to mask its traffic.
Bottom line: The C2 server at 185.225.73.238 runs on Alibaba cloud infrastructure in the Netherlands, and pivoting on its self-signed SSL certificates surfaced a second Cobalt Strike server at 43.154.175.230 in Hong Kong - meaning the same actor likely holds more than one foothold, and the same Bitbucket account also hosted Redline and Amadey payloads.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2017-0199
- Related
- When combining exploits for added effect goes wrong Cyber Risks ·CVE-2017-0199: Microsoft Office and Word Pad Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021