Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Practice Makes Perfect: Nemucod Evolves Delivery and Obfuscation Techniques to Harvest Credentials

Summary: Unit 42 tracked a Nemucod downloader campaign over five months that used weaponized Office documents with password-protected VBA macros to deliver heavily obfuscated JScript and ultimately a credential-stealing Trojan, with Europe seeing the most attacks, followed by the United States and Japan. Researchers catalogued over 50 document versions from late October to March, and on November 30 the actors moved the encoded JScript out of the VBA code and into the Word document body, cutting the macro to under 10 lines that write the content to a .JSE file.

Bottom line: The final payload here is a credential-stealing Trojan, and the campaign's email lures used source addresses with Polish domains and recipient names that matched real LinkedIn profiles - so the credentials your users hold are the target, and the sender looks like someone they know.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related