Malicious Attackers Target Government and Medical Organizations With COVID-19 Themed Phishing Campaigns
Summary: Unit 42 reported COVID-19 themed phishing emails sent from a spoofed noreply@who[.]int address between March 24 and March 26, 2020, to individuals at a Canadian government health organization and a Canadian university doing COVID-19 research, carrying an RTF lure named 20200323-sitrep-63-covid-19.doc that attempted to exploit CVE-2012-0158 to deliver EDA2 ransomware. A separate AgentTesla infostealer campaign, sent from shipping@liquidroam.com with subjects such as 'COVID-19 Supplier Notice,' targeted healthcare, pharmaceutical and government recipients and exfiltrated data over FTP to ftp[.]lookmegarment[.]com, a domain Unit 42 assessed as a compromised legitimate business site.
Bottom line: The ransomware was hardcoded to encrypt only files on the victim's desktop, and Unit 42 states none of the samples reached their intended targets - but the lure was a WHO-branded document aimed squarely at organizations on the pandemic front lines, and the C2 infrastructure was legitimate business domains that had already been compromised.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2012-0158
- Related