SWEED: Exposing years of Agent Tesla campaigns
Summary: Cisco Talos linked a large set of ongoing malware distribution campaigns to a threat actor it calls SWEED, which has operated since at least 2017 and primarily delivers stealers and remote access trojans including Formbook, Lokibot and Agent Tesla. The campaigns consistently use spear-phishing emails with malicious attachments, moving from ZIP droppers in 2017 to Java droppers in early 2018, Office exploits CVE-2017-8759 and CVE-2017-11882 in 2018, and obfuscated Office macros in 2019, with the actor using a packed Agent Tesla as the final payload.
What you should know: Talos tied the campaigns to a shared RDP server with multiple active user accounts and matching handles, indicating a collaborative, business-like operation rather than a lone actor - and it targets manufacturing and logistics companies worldwide with no geographic focus.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2017-11882CVE-2017-8759
- Related
- My Little Form Book Cyber Risks ·