Tuesday, November 5, 2024
HomeMalwareU.S Gov Warns that Hackers Using Phishing Emails Used to Deploy KONNI...

U.S Gov Warns that Hackers Using Phishing Emails Used to Deploy KONNI Malware using Weaponized Word Documents

Published on

Malware protection

U.S CISA recently noticed that hackers using Phishing Emails to deploy KONNNI malware with the help of weaponized Microsoft word documents.

The KONNI RAT was initially found in May 2017 by researchers at the Cisco Talos team after it was operated in attacks that are aimed at businesses linked to North Korea. 

KONNI has been applied in highly targeted attacks only; these include the United Nations, UNICEF, and entities linked to North Korea. Moreover, the expert’s also classified a link between KONNI and DarkHotel.

- Advertisement - SIEM as a Service

The KONNI vulnerability is typically spread through phishing emails holding a Microsoft Word file with an ill-disposed Visual Basic Application (VBA) macro code to deploy the malware. 

The CISA explains that the macro code was created to change the font color to fool the victim into allowing the content, check whether the system design is 32-bit or 64-bit. 

It also creates and runs a command line to download further additional files, while the certificate database tool CertUtil is applied for the download of remote files.

Techniques & Uses

Mitigations

The CISA suggested users and administrators apply the following points to increase the security aspect of their company’s network systems:-

  • Remember to keep up-to-date antivirus signatures and engines.
  • Always maintain your OS patches up to date.
  • Impair the file and printer sharing services. In case if these services are needed, then must apply strong passwords or Active Directory authentication.
  • Always restrict the users’ capability to install and run undesired software applications.
  • Implement a strong password.
  • Practice Caution while you are opening email attachments, even if the attachment is required, and the sender resembles to be known.
  • Allow a private firewall on agency workstations, configured to reject undesirable connection requests.
  • Allow additional services on agency workstations and servers.
  • Always browse for and eliminate all suspicious email attachments; and assure that the scanned attachment is its “true file type.”
  • Always observe the users’ web browsing habits, and restrict entrance to sites with inappropriate content.
  • Practice Caution while using removable media.
  • Always browse all software downloaded from the internet prior to completing it.
  • Manage situational information of the latest threats and perform suitable access limitation lists.

Apart from this, the CISA suggested the users to follow the recommended mitigations carefully so that they can keep themselves protected from all unwanted malicious malware. 

Moreover, the security researchers at CISA are still investigating the whole matter, and they asserted that all the users must follow every recommendation carefully.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read;

Citrix Warns That Hackers May Exploit the New Patched Flaw Quickly

US GOV Exposes Chinese Espionage Malware “TAIDOOR” Secretly Used To For a Decade

Latest articles

ClickFix Exploits GMeet & Zoom Pages to Deliver Sophisticated Malware

A new tactic, "ClickFix," has emerged. It exploits fake Google Meet and Zoom pages...

APT36 Hackers Attacking Windows Deevices With ElizaRAT

APT36, a sophisticated threat actor, has been actively targeting Indian entities with advanced malware...

Hackers Using AV/EDR Bypass Tool From Cybercrime Forums To Bypass Endpoints

Researchers uncovered two previously unknown endpoints with older Cortex XDR agents that used to...

Hackers Created 100+ Fake Web Stores To Steal Millions Of Dollars From Customers

The Phish, 'n' Ships fraud operation leverages, compromised websites to redirect users to fake...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

APT36 Hackers Attacking Windows Deevices With ElizaRAT

APT36, a sophisticated threat actor, has been actively targeting Indian entities with advanced malware...

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy...

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Researchers discovered a Russian-linked threat actor, UNC5812, utilizing a Telegram persona named "Civil Defense....