Tuesday, June 18, 2024

New Hacking Group Using Metasploit To Install Backdoor Malware On Windows By Exploiting MS Office

Researchers detect a wave of malware campaigns from a new hacking group named TA2101 that targeting various organizations in German and Italy to deploy the backdoor malware in their network.

Threat actors from this new hacking group using legitimate and licensed penetration testing tools and backdoor framework such as Cobalt Strike and Metasploit to perform the post-exploitation operation.

These kinds of tools and frameworks are legitimately used by an organization to find out the vulnerabilities and secure their environment, at the same time cybercriminals group such as Cobalt Group, APT32, and APT19 taking advantage of the features and used it to deploy the malware.

Attackers initiate these campaigns focused on phishing and increasingly sophisticated social engineering, as well as banking Trojans and ransomware. 

Researchers observed that this New Hacking Group also distributing Maze ransomware to attack Italy based company’s infrastructure by employing an advanced social engineering technique and impersonate the Italian revenue agency.

Exploiting Windows via Malicious Word Docs

Proofpoint researchers observed this campaign from October 16 until November 12, 2019, the collected samples provide a clear indication about the targets, and how they are sending malicious email messages to organizations in Germany, Italy, United States to attack business and IT services, manufacturing, and healthcare.

Among the several samples that were delivered via malspam emails, most of the email attachment contains weaponized word documents.

Email body content tempts victims to open the attachment that leads to executing the macro and turn it on to execute the PowerShell script.

The obfuscated Powershell script eventually downloads and installs the Maze ransomware from the command & control server and drops into the victim’s device.

Attackers delivering the ransomware via different email campaigns that pointed to the law enforcement activities, impersonating the German Federal Ministry of Finance, tempt victims to avoid further tax assessment and penalties.

In the very recent campaign, Proofpoint researchers observed thousands of emails attempting to deliver malicious Microsoft Word attachments with English lures, this time impersonating the United States Postal Service (USPS) and distributing the IcedID banking Trojan.

Same Weaponised word document used for this campaign, once executed, it installs the IcedID payload onto the targets mainly Healthcare vertical, using the same infection chain.

“Researchers also Observed a consistent set of TTPs (Tactics, Techniques, and Procedures) that allows attribution of these campaigns to a single actor with high confidence. These include the use of .icu domains, as well as identical email addresses for the Start of Authority (SOA) resource records stored for the DNS entries for the domains used in these campaigns”, Proof point said.

You can find the complete analysis and indicators of compromise here to secure your environment.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Singapore Police Arrested Two Individuals Involved in Hacking Android Devices

The Singapore Police Force (SPF) has arrested two men, aged 26 and 47, for...

CISA Conducts First-Ever Tabletop Exercise Focused on AI Cyber Incident Response

On June 13, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) made history by...

Europol Taken Down 13 Websites Linked to Terrorist Operations

Europol and law enforcement agencies from ten countries have taken down 13 websites linked...

New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems

Memory corruption lets attackers hijack control flow, execute code, elevate privileges, and leak data.ARM's...

Operation Celestial Force Employing Android And Windows Malware To Attack Indian Users

A Pakistani threat actor group, Cosmic Leopard, has been conducting a multi-year cyber espionage...

Hunt3r Kill3rs Group claims they Infiltrated Schneider Electric Systems in Germany

The notorious cybercriminal group Hunt3r Kill3rs has claimed responsibility for infiltrating Schneider Electric's systems...

Hackers Employing New Techniques To Attack Docker API

Attackers behind Spinning YARN launched a new cryptojacking campaign targeting publicly exposed Docker Engine...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles