New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed
Summary: Unit 42 researchers identified a commodity macro builder and shared PDF template metadata that let them cluster new infrastructure to the Cobalt Gang, which remains active after the arrest of its alleged leader in Spain this year. The October 2018 campaign used emails such as "Confirmations on October 16, 2018" and "Fund Transfer 08-October-2018" to deliver a code-free PDF that redirected through a Google link to a malicious macro document using cmstp.exe to run a scriptlet and bypass AppLocker.
Bottom line: The delivery chain relied on a PDF with no exploit and a macro document with a very low detection rate, so the signals that tied the campaign together were a 1500-line macro's variable naming and a reused XMP DocumentID - artifacts most security stacks never inspect.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2017-0199
- Related
- Korea In The Crosshairs Cyber Risks ·Free Milk: A Highly Targeted Spear Phishing Campaign Cyber Risks ·CVE-2017-0199: Microsoft Office and Word Pad Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021