Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Musical Chairs: Multi-Year Campaign Involving New Variant of Gh0st Malware

Summary: Unit 42 documented a multi-year campaign it calls Musical Chairs, which in July began deploying a new Gh0st RAT variant named Piano Gh0st that drops Piano.dll and decrypts an embedded DLL using Blowfish with a single-character key. The actors, active for over five years, distribute the malware through compromised US residential ISP email accounts in indiscriminate blasts, and 32 samples dating to July 2013 connect to a single Windows 2003 command server at 98.126.67.114 across 19 TCP ports.

Bottom line: One command and control server has anchored this campaign for almost two years, and the actors behind it have kept operating for over five years using nothing more than a user opening an attached executable - no vulnerability required.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related