Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Power Sniff Malware Used in Macro-based Attacks

Summary: Palo Alto Networks' Unit 42 observed a high-threat spam campaign of roughly 1,500 emails delivering Word documents whose macros invoke WMI to spawn a hidden powershell.exe, which downloads a script that decodes and runs shellcode in memory, injecting malware the researchers call PowerSniff and describe as similar to the Ursnif family. The emails carry victim-specific details such as company phone number, physical address and individual name, and the payload checks for 32-bit versus 64-bit Windows to choose between a '/cache' and a '/css' download URI.

Why it matters: The malware runs sandbox and debugger checks, then marks victims '666' if cached URLs or 'net view' output point to point-of-sale or financial systems and '555' otherwise, while apparently avoiding healthcare and education machines - so the attackers are sorting your estate before they act, and the roughly 1,500 personalized emails mean the targeting starts before anyone clicks.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related