U.S. Gov Agency Targeted With Malware-Laced Emails

guest · Jan 23, 2020

U.S. Gov Agency Targeted With Malware-Laced Emails
The malicious email campaign included a never-before-seen malware downloader called Carrotball
January 23, 2020
https://threatpost.com/u-s-gov-agency-malware-laced-emails/152141/

A U.S. government agency was targeted with spear phishing emails harboring several malware strains – including a never-before-seen malware downloader that researchers call “Carrotball.”

The campaign, which researchers observed occurring from July to October and code-named “Fractured Statue,” involved six unique malicious document lures being sent as attachments from four different Russian email addresses to 10 unique targets.

“Overall, the Fractured Statue campaign provides clear evidence that the TTPs [tactics, techniques and procedures] discovered in Fractured Block are still relevant, and that the group behind the attacks still appears to be active,” said Adrian McCabe with Palo Alto Networks’ Unit 42 research group, in a Thursday analysis.
Once downloaded, the malicious attachments attempted to infect victims with several malware families.
Click to expand...

Carrotball
“Carrotball, initially discovered in an attack during October 2019, is a simple FTP downloader utility which facilitates the installation of SysCon, a full-featured remote access trojan (RAT) which leverages FTP for command and control (C2),” said researchers.
Attribution
Unit 42 researchers said they assess “with moderate confidence” that the activity is related to the Konni Group. First discovered in 2014, Konni is best known for 2018 campaigns using two malware families in cyberattacks, the NOKKI malware and Carrotball.
Click to expand...

Palo Alto Networks - Unit42: The Fractured Statue Campaign: U.S. Government Targeted in Spear-Phishing Attacks

Log in or Sign up

U.S. Gov Agency Targeted With Malware-Laced Emails

guest Guest

Log in or Sign up

U.S. Gov Agency Targeted With Malware-Laced Emails

guest Guest

Useful Searches