Indigo Drop spreads via military-themed lures to deliver Cobalt Strike
Summary: Cisco Talos discovered a campaign using military-themed malicious documents, some masquerading as Indian Air Force Incident Action Plan documents, to drop a modular dropper it calls IndigoDrop that downloads customized Cobalt Strike beacons. The maldocs contain roughly 64 pages and 15,000 words of legitimate content, and the attack chain evolved from an SMB-based Cobalt Strike beacon in 2018 through VBA stagers, custom droppers, and Pastebin-hosted Metasploit shellcode by October 2019.
What's compelling: The lures are weaponized copies of real government and military documents, and the attackers rebuilt their tooling repeatedly over roughly 18 months, so a single detection signature will not hold against an adversary this agile.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026