Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India
Summary: Cisco Talos observed a two-phase campaign using malicious RTF documents to target Afghanistan and India, with a reconnaissance phase deploying a custom file enumerator and infector and an attack phase delivering commodity RATs including DcRAT and QuasarRAT. The actor registered domains with political and government themes, such as af-gov[.]ml and afghancdn[.]world, and Talos assesses with high confidence the activity traces to an individual operating under the guise of a Pakistani IT firm called Bunse Technologies.
Why it matters: The infector module weaponizes every .doc, .docx and .rtf file on removable drives using CVE-2017-11882, so a single infected endpoint can turn trusted documents into carriers that spread the infection inside restricted networks.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-11882CVE-2017-11882
- Related
- Loda RAT Grows Up Cyber Risks ·LodaRAT Update: Alive and Well Cyber Risks ·CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021