Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Dimnie: Hiding in Plain Sight

Summary: In mid-January 2017, Unit 42 researchers observed waves of phishing emails sent to GitHub repository owners, each carrying the same malicious .doc file with an embedded macro that ran a PowerShell command to download and execute a binary payload. That payload, Dimnie, is a modular downloader and information stealer Palo Alto Networks has seen in samples dating back to early 2014, and it disguises its command-and-control traffic as HTTP proxy requests to the defunct Google PageRank service at toolbarqueries.google.com while sending the traffic to an attacker-controlled server resolved from onechat[.]pw.

Key Takeaway: Dimnie's January 2017 campaign marked a global departure from its earlier Russian-focused targeting, and it stayed hidden for roughly three years by making uploads and downloads look like ordinary user traffic - the assumption most defenders build their monitoring on.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related