Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Follow-On to VBA-Initiated Infostealer Campaign: Exploring Related Malware and Actors

Summary: Unit 42 found 14 additional samples communicating with the same two Predator Pain C2 domains between December 27, 2013, and August 1, 2014, all belonging to the Predator Pain keylogger family, with several also packaged with the Limitless keylogger. The samples were almost exclusively downloaded from nova.co[.]in, which shared an IP with the original sample's download domain, and WHOIS pivoting on the C2 domain surfaced a "Josh Frank" persona tied to 419 and dating scams under the organizations "Xteria pte" and "Amorex".

What's compelling: Both keylogger packages sell on the cybercrime underground for under $40, with cracked versions free, and the same infrastructure links a low-cost infostealer operator to fraud personas whose stolen personal and business data can feed more precise second-stage social engineering against companies.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related