Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: Hancitor Actors

Summary: Unit 42 research on Hancitor shows the malware, which primarily delivers banking Trojans that steal banking information, spiking in activity during the middle of the week throughout 2017. The actors shifted from malicious email attachments to malicious links that download the Hancitor document, and they distribute it through fraud-based hosting accounts in the United States and compromised small and medium business sites in Asia.

What's compelling: Hancitor targets outdated Windows systems like Windows 7 and Windows XP and is used in several hundred spam campaigns every month, so unpatched endpoints remain a standing entry point for banking Trojans regardless of how unsophisticated the malware itself is.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related