Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan
Summary: Unit 42 intercepted weaponized documents in late October and early November 2018 that loaded remote templates containing malicious macros, targeting government entities in North America, Europe, and a former USSR state. Analysis revealed a first-stage Zebrocy payload and a previously unobserved C# downloader named Cannon that uses SMTPS over TCP port 587 and POP3S for command-and-control via email accounts rather than HTTP or HTTPS.
What's compelling: Cannon's C2 traffic runs through a legitimate email service provider over encrypted SMTPS and POP3S, which the report describes as a very difficult channel to block - so an organization watching only HTTP and HTTPS egress has no visibility into this campaign.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026