Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Analyzing Oil Rig's Ops Tempo from Testing to Weaponization to Delivery

Summary: Unit 42 researchers linked OilRig's testing of a malicious Excel document to the weaponized Word delivery document used in an August 2018 attack on a Middle Eastern government, tracing three testing waves on August 20, 21, and 26. The final test file was created less than 8 hours before the delivery document, which was sent by spear-phishing email 20 minutes later, and the tester submitted 11 additional samples to public anti-virus scanning sites to gauge detections.

Why it matters: OilRig used free public anti-virus scanners as a quality-assurance service, cutting detections from 22 engines to as low as six through iterative changes before building the final document. That means the same scanning tools defenders rely on were giving the adversary a six-day head start and a map of what evades detection.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related