Threat Source newsletter (Sept. 30, 2021)
Summary: Cisco Talos reported a campaign in which attackers nearly perfectly copied Amnesty International's website and advertised a tool to detect and remove Pegasus spyware, but no such software exists and the download instead installs a RAT. Talos also detailed "Operation: ArmorPiercer," which targets government employees and military personnel in the Indian subcontinent with NetwireRAT and WarzoneRAT delivered through malicious Office documents and RAR/ZIP archives posing as guides to Indian government infrastructure such as Kavach.
Bottom line: The Pegasus lure works because the fear is real: people searching for spyware removal will download a fake tool from a cloned Amnesty site and hand over a remote-access trojan. Operation: ArmorPiercer shows commercial RATs aimed at government and military personnel, with footholds likely used to deploy additional plugins and modules.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2021-22005
- Related
- CVE-2021-22005: VMware vCenter Server File Upload Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021