Net Traveler Spear-Phishing Email Targets Diplomat of Uzbekistan
Summary: Unit 42 reported a spear-phishing email sent on December 12, 2015 to a diplomat at the Embassy of Uzbekistan, likely based in Beijing, spoofed to appear as if from the Russian Foreign Ministry with an attachment posing as an SCO annual report. The attachment, built with the MNKit toolkit, exploited CVE-2012-0158 to install the NetTraveler Trojan via DLL side-loading of a legitimate Symantec executable and a renamed rastls.dll.
Why it matters: NetTraveler has been used against diplomats, embassies and government institutions for over a decade, and the C2 domain voennovosti[.]com resolved to 98.126.38[.]107 at Krypt Technologies - the same hosting provider Kaspersky linked to NetTraveler in 2011, showing the actors' infrastructure has outlasted a decade of defense.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2012-0158
- Related
- Bad Patch Cyber Risks ·