Threat actors attempt to capitalize on coronavirus outbreak
Summary: Cisco Talos found several malicious spam campaigns using coronavirus-themed emails and filenames to lure victims into opening attachments, distributing Emotet, Nanocore RAT, and various trojans. The campaigns included Word documents that prompt users to Enable Editing and Enable Content, a ZIP file containing a PIF executable that installed Nanocore RAT, and a .pdf.ace invoice file whose final payload could not be retrieved because the command and control servers were down.
What you should know: Talos noted a large volume of legitimate coronavirus-related emails with Word and Excel attachments, which is exactly what makes these lures effective - Emotet is also known to steal emails and reply in-line, so a malicious attachment can arrive inside a real thread from a colleague or friend.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026