Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Attack Campaign on the Government of Thailand Delivers Bookworm Trojan

Summary: Unit 42 reports that threat actors delivered a Trojan called Bookworm as a payload in attacks on targets in Thailand, with attempted attacks on at least two branches of the Thai government and 73% of hosts communicating with Bookworm command-and-control servers located in Thailand. The malware carries hardcoded date strings, such as 20150716 and 20150818, that Unit 42 assesses are campaign codes rather than build identifiers, and these codes precede the associated attack or decoy event dates by 6 to 18 days.

Key Takeaway: The actors built decoy slideshows around Thai news events, including the August 17, 2015 Erawan Shrine bombing and the arrest of suspect Adem Karadag, and hosted Bookworm on legitimate websites they had compromised, so the infrastructure behind this campaign was borrowed from sites their targets had no reason to distrust.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related