The Blockbuster Saga Continues
Summary: Unit 42 researchers at Palo Alto Networks identified new attack activity targeting individuals involved with United States defense contractors, using weaponized Microsoft Office documents with the same malicious macros seen in earlier 2017 attacks. The attackers switched from Korean to English language speakers, with decoy documents now themed on job descriptions and internal policies from US defense contractors, and attacks continued through July 2017.
Key Takeaway: The group tied to Operation Blockbuster has kept operating despite public exposure, reusing the same tools, XOR keys, and command-and-control IP addresses such as 210.202.40[.]35 - so defense contractor staff opening a job-description document remain a live entry point.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026