How adversaries use politics for compromise
Summary: Cisco Talos analyzed a malspam campaign and found hundreds of politically themed pieces of software, including a "trump.exe" PE32 executable retrieved from an attacker server via Dynamic Data Exchange in an RTF document, "Putin Lockware 2.0," and a "Donald Trump Screen of Death" locker. The same lures delivered Konni RAT through a Word document titled "12 things Trump should know about North Korea.doc," ROKRAT through an Excel spreadsheet with an embedded SWF file, and PoisonIvy through a malicious macro spreadsheet.
Key Takeaway: Talos notes that advanced, sophisticated adversaries will use any means to achieve their goals, and this campaign tied nation-state-linked malware families to political headlines that employees are likely to open.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Wasted Locker Goes "Big-Game Hunting" in 2020 Cyber Risks ·