Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks

Summary: Between July and October 2019, Unit 42 observed Konni Group-associated malware used against a US government agency, with six unique malicious document lures sent from four Russian email addresses to 10 unique targets, using North Korea geopolitical themes written in Russian as bait. Five documents carried CARROTBAT downloaders and one carried a new downloader dubbed CARROTBALL, all delivering SYSCON remote access trojans that used FTP for command and control via downplease.c1[.]biz and lookplease.c1[.]biz, both resolving to 185.176.43[.]94.

What's compelling: Ten targets, including a US government agency and two non-US foreign nationals professionally associated with North Korea, received these lures, and Unit 42 attributes the activity to the Konni Group only with moderate confidence because published technical detail lets copycats or false-flag actors mimic the same TTPs.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related