A year of Fajan evolution and Bloomberg themed campaigns
Summary: Cisco Talos documented sustained Fajan campaigns using Bloomberg BNA Invoice-themed email attachments to deliver JavaScript- and VBScript-based RATs, with the actor actively developing the campaigns since at least March 2020. The VBA droppers hide code fragments in Excel spreadsheet cells, pull payloads from Pastebin and the Top4top.io file-sharing site, and in one variant deliver a cracked Nanocore RAT injected into msbuild.exe with a C2 server at 79.134.225.33 on TCP port 83.
Key Takeaway: The actor's cell-based code hiding is built specifically to defeat defenders who only scan the usual macro streams, and the shared C2 infrastructure with Netwire RC, Revenge RAT and XpertRAT means your existing detections for those families may already cover this one - or may be missing it entirely.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026