Fake Employment Site Created to Target Veterans With Malware

guest · Sep 24, 2019

Fake Employment Site Created to Target Veterans With Malware
September 24, 2019
https://www.bleepingcomputer.com/ne...site-created-to-target-veterans-with-malware/

A fake web site pretending to be an organization that offers job opportunities for U.S. veterans is distributing malware that let's the attackers gain full control over a victim's computer.
Researchers from the Cisco Talos Group have a found a web site that pretends to be the organization called HMH, or Hire Military Heroes, that offers a desktop application that veterans can use for job opportunities.

When a user visits the site, they will be prompted to download a program for either Windows 8, 8.1, or Windows 10. For the Windows 10 download, it is a zip file containing a program named win10.exe. This file is currently only detected by 3/69 vendors on Virustotal.

The first program that is downloaded will execute 111 commands that are used to gather information about the computer and its victims.
Installs Remote Access Trojan
In addition to the information gathering malware, a remote access Trojan will also be installed on the computer. This Trojan will be installed as a Windows service with a service name of "dllhost" and a display name of "Dll host".
Click to expand...

Cisco Talos: How Tortoiseshell created a fake veteran hiring website to host malware

CONCLUSION
This new campaign utilizing the malicious hiring website represents a massive shift for Tortiseshell. This particular attack vector has the potential to allow a large swath of people to become victims of this attack. Americans are quick to give back and support the veteran population. Therefore, it's this website has a high chance of gaining traction on social media where users could share the link in the hopes of supporting veterans.

At the time of publication, we do not have a method of distribution used, nor do we have proof of this existing in the wild. The level of sophistication is low as the .NET binary used has poor OPSEC capabilities, such as hard-coded credentials, but then other more advanced techniques by making the malware modular and aware that the victim already ran it.
Click to expand...

Log in or Sign up

Fake Employment Site Created to Target Veterans With Malware

guest Guest

Log in or Sign up

Fake Employment Site Created to Target Veterans With Malware

guest Guest

Useful Searches