Threat Source newsletter for May 7, 2020
Summary: Cisco Talos reported a new Aggah spam campaign that pushes malicious Microsoft Office documents through malspam emails in a multi-stage infection ending in remote-access tools such as Agent Tesla, njRAT and Nanocore RAT, using multiple Pastebin accounts to host different attack stages. Microsoft also warned of Remcos campaigns using COVID-19-themed lure files, including crafted disk image files, targeting the U.S. Small Business Administration and manufacturing companies in South Korea.
What you should know: The Aggah operators split their infrastructure across multiple Pastebin accounts, so blocking a single host no longer breaks the chain, and the Remcos lures reached a named U.S. federal agency and South Korean manufacturers using pandemic subject lines your users are still primed to open.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026