Forest Global Training Partners

Cyber Risks · Cisco Talos

How Tortoiseshell created a fake veteran hiring website to host malware

Summary: Cisco Talos reported that Tortoiseshell built a fake veteran hiring website whose only function was three links to download a free desktop app, which was actually a fake installer. The installer checks whether Google is reachable, then downloads two base64-encoded binaries from 199[.]187[.]208[.]75 - a reconnaissance tool and a remote administrative tool executed as a service - and emails system details, including patch level, network configuration, domain controller and admin name, to hardcoded Gmail accounts.

What you should know: The installer's reconnaissance pulls the domain controller, admin name and account list off the machine, so a single user who trusts a hiring site hands the attacker the map needed for the next attack. Talos also notes it has no method of distribution and no proof this exists in the wild, so the confirmed exposure is the tooling, not a known victim.

Read the original at Cisco Talos ↗

Topics
Malware
Related