Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Source Newsletter (Nov. 18, 2021)

Summary: Cisco Talos reported a new malicious campaign using a leaked version of Cobalt Strike, in which a loader decodes and executes the Cobalt Strike beacon DLL via reflective injection and sends an initial DNS request to the Myanmar government-owned domain www[.]mdn[.]gov[.]mm, with actual command-and-control traffic redirected through Cloudflare to an attacker-controlled server at test[.]softlemon[.]net. Talos also observed a Kimsuky campaign active since June 2021 that uses malicious Blogspot blogs to deliver beacons, file exfiltrators and implant deployment scripts targeting South Korea-based think tanks researching political, diplomatic and military topics on North Korea, China, Russia and the U.S.

Key Takeaway: Kimsuky, a North Korean state-sponsored APT active since 2012, is delivering keyloggers and credential stealers to think tanks studying North Korea, China, Russia and the U.S. through ordinary Blogspot pages, and the Cobalt Strike beacon's use of a government domain behind Cloudflare shows how far a leaked legitimate tool can carry an intrusion.

Read the original at Cisco Talos ↗

Topics
Malware
Related