Threat Spotlight: "A String of Paerls", Part 2, Deep Dive
Summary: Cisco Talos detailed a spearphishing campaign in which malicious Word documents carrying similar auto-generated VBA macros download and launch executables, with sample filenames including shipping and invoice lures such as "RE: Container number CMAU5861946 and CMAU5735393" and "Invoice76453773.doc". Analysis of the payload found the Andromeda trojan family, identified by the mutex "lol", which injects code into wuauclt.exe and svchost.exe and uses the default RC4 key d40e75961383124949436f37f45a8cb6.
Bottom line: The operators left default builder strings and the default RC4 key in place, and the attack still depends on a user enabling macros in a document from an unknown sender - the same weakest link Microsoft tried to close by disabling auto-open macros years ago.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026