Tracking Subaat: Targeted Phishing Attack Leads to Threat Actor's Repository
Summary: Unit 42 observed 43 phishing emails beginning July 16, 2017, targeting a US-based government organization, delivering two RTFs exploiting CVE-2012-0158 and an Excel file with macros that dropped Crimson Downloader and QuasarRAT. Tracking the payload host subaat[.]com revealed an open directory with 84 unique malware payloads, and logs showed the IP 115.186.136[.]237, tied to a Pakistan-based ISP, uploading and interacting with 64 unique files between July 1 and July 20.
What you should know: A single open directory exposed 84 malware payloads and an operator's working habits, including a HackForums account named 'Subaat' linked by email to the same infrastructure - the attacker's own repository became the evidence trail.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2012-0158
- Related