My Little Form Book
Summary: Cisco Talos described a phishing email posing as an order from a Spanish company's sales department that carried two attachments and chained two public Microsoft Office exploits, CVE-2017-0199 and CVE-2017-11882, to drop a final payload. The payload was downloaded from a Japanese file-sharing platform hosted in the Netherlands, and the actor's infrastructure overlapped with a February 2017 Pony campaign, suggesting a move from Pony to FormBook, an inexpensive malware-as-a-service stealer that records keystrokes, steals locally stored and web-form passwords, and takes screenshots.
Key Takeaway: The actor behind this campaign has kept the same infrastructure running for more than a year, switching stealers from Pony to FormBook while the delivery chain stayed the same. Two Office exploits that were already public were enough to get FormBook onto a target, and FormBook's job is to lift the passwords and keystrokes that sit behind your other controls.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2017-0199CVE-2017-11882
- Related