PSA: Conference Invite used as a Lure by Operation Lotus Blossom Actors
Summary: Actors tied to Operation Lotus Blossom used Palo Alto Networks' Cyber Security Summit in Jakarta on November 3, 2016 as a phishing lure, sending a malicious attachment named "[FREE INVITATIONS] CyberSecurity Summit.doc" that exploits CVE-2012-0158 to install an Emissary Trojan variant, version 6.4. The decoy document's cropped screenshots, taken on a Windows system localized for Chinese with the Sogou Pinyin input method, showed a local time of 8:35 and 8:36 AM on October 19, 2016, while the decoy file itself was created at 7:51 AM UTC.
Key Takeaway: The actor built the decoy from screenshots of a legitimate invitation email, indicating access to an inbox that received it - meaning the same lure that reached your peers can be turned into a weapon aimed back at them. The payload beacons to C2 server 103.249.31[.]49 and persists via a registry key on every startup, so a single opened attachment outlives the phishing campaign itself.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-0158
- Related
- When combining exploits for added effect goes wrong Cyber Risks ·