Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Aggah Campaign: Bit.ly, Blog Spot, and Pastebin Used for C2 in Large Scale Campaign

Summary: Unit 42 traced an attack campaign it named Aggah, beginning with a March 27, 2019 email spoofing a large Middle Eastern financial institution with the subject "Your account is locked" and an attached "Activity.doc" that used Template Injection to load a remote OLE document. The chain pulled a script from a BlogSpot post via a Bit.ly link, used Pastebin pastes to download further scripts, and installed RevengeRAT configured with a duckdns[.]org domain for command and control, with related documents later seen targeting the United States, Europe and Asia.

Key Takeaway: The malicious script removed Microsoft Defender's signature set, killed Defender and Office processes, and set registry keys to enable macros and disable ProtectedView across Office 11.0 through 16.0 - so the tooling that was supposed to stop the payload was turned off before it ran.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related