As Usual, Attackers Were Busy Over the Holiday Season
Summary: Unit 42 examined November 25 through December 29, 2015 and identified nearly 4 million phishing attacks with malicious attachments, then filtered for holiday-themed keywords such as Christmas, holiday, and Santa. Roughly 80 percent of the holiday-themed sessions came from a single higher education organization, carrying Bartallex/Dridex macro malware delivering Pony, Rodecap, and Zeus payloads, while macro malware in the Dridex or Bartallex families made up 50 percent of all holiday-themed malware.
Bottom line: One compromised organization accounted for about 80 percent of the holiday-themed phishing sessions Unit 42 observed, which is what a focused campaign looks like when it lands inside a single institution. A separate targeted attack used CVE-2012-0158 in a Christmas-themed Word document to install LURK0, a Gh0st RAT variant whose source code is freely available and has been used by both nation-state groups and cybercriminals.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-0158
- Related
- When combining exploits for added effect goes wrong Cyber Risks ·