A new campaign using Weaponized Microsoft Publisher File(.pub) to deliver the FlawedAmmyy RAT. The FlawedAmmyy RAT is a backdoor tool that gains remote access to the attacker.
Security researchers from Trustwave spotted the Email campaign subjected “Payment Advice” with Microsoft Office Publisher file attached.
Once the .pub file is opened it asks the victim’s to Enable Macros, the macro script triggers Document_Open() event which opens the file and once the file is opened it access the URL that located in the Tag Property and executes a downloaded file.
At the time of analysis the URL was not active, but with further analysis, it was identified that the URL was used to download the self-extracting archive that contains the FlawedAmmyy RAT.
The FlawedAmmy RAT functions as follows
Remote Desktop control
File system manager
Proxy support
Audio Chat
With further analysis in the Cuckoo Sandbox, researchers confirmed that the backdoor accessed a certain IP related to FlawedAmmyy. It transfers the information such as id”, “os”, “names” and credentials from the victim’s machine to attacker’s server.
Researchers said this campaign is unusual and it was originated from the infamous notorious Necurs botnet. The campaign was small and it particularly targets domains belonging to banks.
With the previous campaign, attackers deliver FlawedAmmyy RAT via Weaponized Microsoft Word and PDF Attachments to spy victims device and steal the sensitive information Remotely.
Beware of FlawedAmmyy-RAT that Steals Credentials and Record Audio Chat
Beware !! Hackers Deliver FlawedAmmyy RAT via Weaponized Microsoft Word and PDF Documents
New KeyPass Ransomware Actively Attacking Around the World To Encrypt the Victim Files
A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…
A threat actor known as #LongNight has reportedly put up for sale remote code execution…
Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…
Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…
The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…
Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…