Bad Patch
Summary: Palo Alto Networks Unit 42 traced a Middle Eastern campaign back to at least June 2012, finding 148 malware samples across four categories - Visual Basic, AutoIt, an AutoIt downloader/dropper, and Android malware - tied to linked C2 domains including pal4u[.]net and pay2earn[.]net. The actors used spear phishing and, for the first time in a Gaza Hackers-linked campaign, the RTF exploit CVE-2012-0158 to deliver "BadPatch" Windows malware, and ran their own 2FA-protected "Records Management System" to manage stolen victim data.
What's compelling: A bug in that management system let researchers bypass authentication and enumerate victims through March 2016, showing the operators' own tooling was as exposed as their targets' - and the campaign had already been running for over five years before it was found.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2012-0158
- Related