Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Sofacy Uses Dealers Choice to Target European Government Agency

Summary: Unit 42 observed the Sofacy group attacking a European government agency on March 12 and March 14 using an updated variant of its DealersChoice Flash exploitation framework, delivered via a spear-phishing email with a "Defence & Security 2018 Conference Agenda.docx" attachment. In this variant the embedded Flash object only loads after the user scrolls to the third page of the document, an anti-sandbox technique Unit 42 says it had not previously seen in use.

Bottom line: The exploit stays dormant until a human scrolls to page three, so sandboxes that open the document and wait will see nothing - and the payload itself is pulled from the C2 server at ndpmedia24[.]com, meaning the malicious content never sits in the attachment for static analysis to find.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related