Salfram: Robbing the place without removing your name tag
Summary: Cisco Talos documented ongoing email campaigns in which attackers used organizations' own website contact forms to send fake copyright-infringement complaints linking to malware hosted on Google Drive. The delivered Office documents carried macros that pulled down information stealers, banking trojans and loaders including Gozi ISFB, ZLoader, SmokeLoader, Oski, AveMaria and Cobalt Strike, all packed with a crypter whose samples share the string "Salfram" in a modified DOS header.
Bottom line: The entry point was the contact form on the victim's own website, so the first email arrived through a channel most organizations treat as trusted inbound correspondence. The same crypter is actively maintained and produces binaries that look entirely different from one another, which means signature-based detection of the packed payload is not a reliable backstop.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026