Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Source (April 18): New attacks distribute Formbook, Loki Bot

Summary: Cisco Talos reported that from mid-February through mid-March it monitored phishing campaigns purporting to come from a legitimate domain registered to a large oil and gas organization, targeting a legitimate oil and gas organization in the Middle East with malware similar to LokiBot and Formbook. The same newsletter described a zero-day in Internet Explorer's handling of MHT files that could let an attacker exfiltrate local files and gather installed program version information, potentially without any user interaction.

Bottom line: The IE flaw can be triggered automatically without user interaction, so a single opened MHT file is enough for an attacker to pull local files and inventory installed software. The Middle East energy campaign ran for a month using a spoofed domain from a large oil and gas organization, which means the sender name your users trust may be the lure.

Read the original at Cisco Talos ↗

Topics
Malware
Related