Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware

Summary: Unit 42 tracked a malspam campaign it calls "Blank Slate" that sends emails with no body text and a double-zipped attachment containing either a macro-enabled Word document or a .js file, which launches PowerShell to download and run ransomware on Windows hosts. The campaign used 555 domains over seven months, and in a five-day window from January 29 to February 2, 2017, researchers found at least eight domains across seven IP addresses hosting Cerber, with domains registered a day or two before use and staying active up to seven days or more.

What's compelling: The actors rebuild infrastructure for roughly the price of a burner phone and a $5 set of stolen card credentials, so takedowns of 555 domains over seven months did not stop the campaign - the hosting provider abuse cycle simply restarted.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related