Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Examining a VBA-Initiated Infostealer Campaign

Summary: Unit 42 documented a spear-phishing campaign that sent a spoofed email, appearing to come from an energy company, to an employee who processes financial statements at a global financial organization, delivering a malicious DOC file named TTAdvise.doc. When the victim enabled macros, an embedded VBA script downloaded a second-stage binary, oludouble.exe, from hxxp://icqap.com/oludouble.exe, which dropped copies of itself, established persistence via the HKCU Run key 'Windows Update,' and used the Predator Pain keylogger to steal information and connect to actor-run SMTP and FTP command-and-control servers.

Key Takeaway: Unit 42 attributes the campaign to 'Skozzy,' a carder active in the cybercrime underground since at least 2010, and notes that none of the major antivirus vendors detected the threat at delivery - the gap between a new threat and a signature is where this campaign succeeded.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Phishing & Social Engineering
Related