Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Attack Delivers ‘9002’ Trojan Through Google Drive

Summary: Unit 42 observed a 9002 Trojan delivered through a TinyURL shortened link that redirects to an actor-controlled server at 222.239.91[.]152, which decodes base64 data containing a targeted Gmail address and a second shortened link pointing to a Zip file on Google Drive. The Zip contains a dropper disguised with a PowerPoint icon that sideloads a malicious MPAMedia.dll via a legitimate RealNetworks executable, persists through a Run registry key, and beacons to the C2 domain logitechwkgame[.]com on TCP port 80.

Key Takeaway: The redirection server decodes a real Myanmar politician's Gmail address to track which targeted recipients clicked, and the same infrastructure ties to Poison Ivy activity against Myanmar and a possibly ongoing campaign against Taiwan's Mainland Affairs Council. A payload hosted on Google Drive and fronted by a TinyURL link means the delivery chain looks like ordinary traffic to a trusted provider, which is exactly what link shorteners are built to obscure.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related