Farming Malicious Documents to Unravel Ransomware
Summary: Unit 42 analyzed a malicious Microsoft Word document that used an obfuscated macro to launch a PowerShell process, downloading the SAGE 2.0 (Sage Locker) ransomware, a spin-off of CryLock, with the command broken up by Windows caret escape characters to evade string matching. Pivoting off the URL path "read.php?f=0.dat" through AutoFocus, the researcher identified 9,107 unique Word documents since December 15, 2016, and WHOIS data revealed 574 domains tied to a small set of registrant identities, each holding between 125 and 160 domains except one with nine.
Key Takeaway: A single registrant identity controlling roughly 125 to 160 domains means blocking one delivery site does little; the same actor has hundreds more, and the campaigns rotated between Sage and Cerber from the same download locations within a single day.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026