Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Compromised Servers & Fraud Accounts: Recent Hancitor Attacks

Summary: Unit 42 tracked Hancitor malspam for two years, observing several hundred examples each month in 2017, with the malware delivered through Microsoft Office documents that infect Windows hosts and typically end in a banking Trojan. Since the end of 2016 the actors shifted from email attachments to links pointing at distribution servers, which are either compromised legitimate business webservers or fraud-based accounts at hosting providers, and since early October 2017 those servers have usually been set up through fraudulent hosting accounts.

Why it matters: The campaign stays profitable on a narrow base of victims running outdated Windows with anti-virus disabled, and its distribution depends on vulnerable servers worldwide, with most compromised domains in Asia belonging to small and medium businesses running PureFTPd or ProFTPd services.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related