New BabyShark Malware Targets U.S. National Security Think Tanks

guest · Feb 22, 2019

New BabyShark Malware Targets U.S. National Security Think Tanks
February 22, 2019
https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/

In February 2019, Palo Alto Networks Unit 42 researchers identified spear phishing emails sent in November 2018 containing new malware that shares infrastructure with playbooks associated with North Korean campaigns.
Malicious Documents
BabyShark is a relatively new malware. The first sample we observed is from November 2018. The decoy contents of all malicious documents delivering BabyShark were written in English and were related to Northeast Asia’s regional security issues.

Well-crafted spear phishing emails and decoys suggest that the threat actor is well aware of the targets, and also closely monitors related community events to gather the latest intelligence.
While not conclusive, we suspect that the threat actor behind BabyShark is likely connected to the same actor who used the KimJongRAT malware family, and at least shares resources with the threat actor responsible for the STOLEN PENCIL campaign.
Click to expand...

guest · Feb 22, 2019

The song itself is a malware for the brain

guest · Apr 26, 2019

BabyShark Malware Part Two – Attacks Continue Using KimJongRAT and PCRat
April 26, 2019
https://unit42.paloaltonetworks.com...-attacks-continue-using-kimjongrat-and-pcrat/

The attackers expanded targeting to the cryptocurrency industry, showing that those behind these attacks also have interests in financial gain.

While tracking the latest activities of the threat group, Unit 42 researchers were able to collect both the BabyShark malware’s server-side and client-side files, as well as two encoded secondary PE payload files that the malware installs on the victim hosts upon receiving an operator’s command.
We presume that the BabyShark malware toolset is shared among actors under the same umbrella or the same group has been assigned an additional mission.

In our analysis, we found BabyShark attacks were using KimJongRAT and PCRat as the encoded secondary payload and thus were the “Cowboys”.
Malicious attacks using the BabyShark malware also seem likely to continue based on our observations and may continue expanding into new industries.
Click to expand...

Log in or Sign up

New BabyShark Malware Targets U.S. National Security Think Tanks

guest Guest

guest Guest

guest Guest

Log in or Sign up

New BabyShark Malware Targets U.S. National Security Think Tanks

guest Guest

guest Guest

guest Guest

Useful Searches