Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Top Hat Campaign: Attacks Within The Middle East Region Using Popular Third-Party Services

Summary: Palo Alto Networks Unit 42 reported a wave of attacks it calls TopHat, beginning in early September 2017, that used Arabic-language decoy documents tied to Palestinian political events to deliver a new backdoor family named Scote through four methods: malicious RTFs, a bitmap-based shellcode technique called Don't Kill My Cat, RTFs exploiting CVE-2017-0199, and self-extracting executables. Scote pulled command-and-control information from Pastebin links and Google+ profiles, with bit.ly links obscuring the C2 URLs, and redirect statistics showed most downloads originating from the Palestinian Territories and the United Arab Emirates.

What's compelling: The attacker behind TopHat was observed submitting samples to a multi-product scanning service one to ten minutes apart, tweaking the RTF object-update string between iterations, and the same submitter later uploaded samples attributed to the DustySky campaign - a reminder that the person probing your detection stack may already be running a second, older campaign against the same region.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related