Free Milk: A Highly Targeted Spear Phishing Campaign
Summary: In May 2017, Palo Alto Networks Unit 42 identified a limited spear phishing campaign, named FreeMilk, that exploited the CVE-2017-0199 Microsoft Word remote code execution vulnerability with decoy content customized per target and emails sent from compromised accounts tied to a legitimate North East Asian domain. The malicious documents delivered two payloads, PoohMilk and Freenki, with PoohMilk setting registry persistence to launch Freenki, which beacons to its C2 every 25 seconds, collects host information, takes up to three screenshots, and retrieves a secondary C2 to download further payloads.
What you should know: The actor hijacked existing, legitimate email conversations and tailored each decoy to the thread, so the phishing came from real senders inside a real domain - and Unit 42 could not identify the second-stage malware Freenki delivered, leaving the campaign's final payload unknown.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2017-0199
- Related
- Korea In The Crosshairs Cyber Risks ·New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed Cyber Risks ·CVE-2017-0199: Microsoft Office and Word Pad Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021