Threat Actors Target Government of Belarus Using CMSTAR Trojan
Summary: Palo Alto Networks Unit 42 observed 20 unique phishing emails between June and August targeting Belarus government entities, using subject lines built around the Zapad 2017 Russian-Belarusian military exercises held September 14 to 20. The attachments - RTF and Word documents and a RAR archive - delivered three CMSTAR variants and two previously unknown backdoors Unit 42 named PYLOT and BYEBY.
Bottom line: The RTF documents exploited CVE-2015-1641, a vulnerability patched in 2015, meaning an unpatched Word install was enough to hand attackers command execution on a government workstation. The lures were built on a real, publicly scheduled military exercise, so the same template works against any organization whose staff follow current events.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2015-1641
- Related
- New Sofacy Attacks Against US Government Agency Cyber Risks ·CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021