Thursday, December 19, 2024
HomeMalwareU.S Gov Warns that Hackers Using Phishing Emails Used to Deploy KONNI...

U.S Gov Warns that Hackers Using Phishing Emails Used to Deploy KONNI Malware using Weaponized Word Documents

Published on

SIEM as a Service

U.S CISA recently noticed that hackers using Phishing Emails to deploy KONNNI malware with the help of weaponized Microsoft word documents.

The KONNI RAT was initially found in May 2017 by researchers at the Cisco Talos team after it was operated in attacks that are aimed at businesses linked to North Korea. 

KONNI has been applied in highly targeted attacks only; these include the United Nations, UNICEF, and entities linked to North Korea. Moreover, the expert’s also classified a link between KONNI and DarkHotel.

- Advertisement - SIEM as a Service

The KONNI vulnerability is typically spread through phishing emails holding a Microsoft Word file with an ill-disposed Visual Basic Application (VBA) macro code to deploy the malware. 

The CISA explains that the macro code was created to change the font color to fool the victim into allowing the content, check whether the system design is 32-bit or 64-bit. 

It also creates and runs a command line to download further additional files, while the certificate database tool CertUtil is applied for the download of remote files.

Techniques & Uses

Mitigations

The CISA suggested users and administrators apply the following points to increase the security aspect of their company’s network systems:-

  • Remember to keep up-to-date antivirus signatures and engines.
  • Always maintain your OS patches up to date.
  • Impair the file and printer sharing services. In case if these services are needed, then must apply strong passwords or Active Directory authentication.
  • Always restrict the users’ capability to install and run undesired software applications.
  • Implement a strong password.
  • Practice Caution while you are opening email attachments, even if the attachment is required, and the sender resembles to be known.
  • Allow a private firewall on agency workstations, configured to reject undesirable connection requests.
  • Allow additional services on agency workstations and servers.
  • Always browse for and eliminate all suspicious email attachments; and assure that the scanned attachment is its “true file type.”
  • Always observe the users’ web browsing habits, and restrict entrance to sites with inappropriate content.
  • Practice Caution while using removable media.
  • Always browse all software downloaded from the internet prior to completing it.
  • Manage situational information of the latest threats and perform suitable access limitation lists.

Apart from this, the CISA suggested the users to follow the recommended mitigations carefully so that they can keep themselves protected from all unwanted malicious malware. 

Moreover, the security researchers at CISA are still investigating the whole matter, and they asserted that all the users must follow every recommendation carefully.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read;

Citrix Warns That Hackers May Exploit the New Patched Flaw Quickly

US GOV Exposes Chinese Espionage Malware “TAIDOOR” Secretly Used To For a Decade

Latest articles

Beware Of Malicious SharePoint Notifications That Delivers Xloader Malware

Through the use of XLoader and impersonating SharePoint notifications, researchers were able to identify...

Malicious Supply Chain Attacking Moving From npm Community To VSCode Marketplace

Researchers have identified a rise in malicious activity on the VSCode Marketplace, highlighting the...

Hackers Weaponizing LNK Files To Create Scheduled Task And Deliver Malware Payload

TA397, also known as Bitter, targeted a Turkish defense organization with a spearphishing email...

BADBOX Botnet Hacked 74,000 Android Devices With Customizable Remote Codes

BADBOX is a cybercriminal operation infecting Android devices like TV boxes and smartphones with...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

Beware Of Malicious SharePoint Notifications That Delivers Xloader Malware

Through the use of XLoader and impersonating SharePoint notifications, researchers were able to identify...

Malicious Supply Chain Attacking Moving From npm Community To VSCode Marketplace

Researchers have identified a rise in malicious activity on the VSCode Marketplace, highlighting the...

Hackers Weaponizing LNK Files To Create Scheduled Task And Deliver Malware Payload

TA397, also known as Bitter, targeted a Turkish defense organization with a spearphishing email...