Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Curious Case of Notepad and Chthonic: Exposing a Malicious Infrastructure

Summary: Unit 42 traced a single suspicious PowerShell sample to an infrastructure of 707 IP addresses and 2,611 domains used to distribute Chthonic, Nymaim, Locky and Hancitor, and to host phishing and carding sites. Pivoting from 171 samples that downloaded payloads from the legitimate Notepad++ site, the researcher found 6,034 unique samples making POST requests to the same domains, with at least three large campaigns active in July.

Bottom line: One analyst's curiosity about a single malformed macro turned into 707 IPs and 2,611 domains of shared criminal infrastructure - the same hosts serving banking Trojans, ransomware droppers and phishing kits - which means blocking one indicator in isolation leaves the rest of that footprint live on your network.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related