Evilgrab Delivered by Watering Hole Attack on President of Myanmar’s Website
Summary: Unit 42 observed a watering hole attack on the President of Myanmar's website, where an IFRAME injected into a Drupal theme JavaScript file infected visitors, with evidence suggesting the actors had access since November 2014 or earlier. A May 12, 2015 visit to a malicious URL on the site delivered an Evilgrab Trojan variant (V2014-v05) that checks for Kaspersky, TrendMicro, Norton, ESET, or AVG before running and injects code into winlogon.exe.
Bottom line: The site was compromised for roughly six months before discovery, and a globally recognized oil and gas organization was among the visitors who triggered the Evilgrab download - a reminder that a trusted government domain can serve as the delivery vehicle for espionage malware against named industries.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2014-6332
- Related
- CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022