Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Updated Back Config Malware Targeting Government and Military Organizations in South Asia

Summary: Unit 42 observed four months of BackConfig malware activity by the Hangover threat group, targeting government and military organizations in South Asia through spear-phishing with local and topical lures. The initial infection arrives via a weaponized Microsoft Excel document with VBA macro code, delivered through compromised legitimate websites whose URLs are likely shared by email, and the modular trojan can gather system and keylog information and download and execute additional payloads.

What you should know: One sample was downloaded by a government department in one country and a military organization in another within minutes of each other, and the malware's split-component design is built to thwart sandbox and dynamic analysis when components are examined in isolation.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related