Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA

Summary: Unit 42 and ClearSky documented targeted attacks in the Middle East using two new Windows malware families, KASPERAGENT and MICROPSIA, with activity likely dating to July 2015 and monitored from March 2016. The attacks used bit.ly-shortened links in spear phishing emails and fake news sites to deliver RAR-hosted payloads, targeting users mostly in the United States, Israel, Palestinian Territories, and Egypt, and were linked through a domain registered to adam.swift.2016@gmail.com to two Android families, SECUREUPDATE and VAMP.

What you should know: One bit.ly link in a MICROPSIA campaign reached 113 users in Egypt, and the attackers paired malware with credential phishing to get two chances at the same target - a reminder that shortened links and archive files still get past basic checks.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related