An Evolved ‘Adwind RAT’ Campaign is Troubling Companies

guest · Feb 20, 2020

An Evolved ‘Adwind RAT’ Campaign is Troubling Turkish Companies
February 18, 2020
https://www.technadu.com/evolved-adwind-rat-campaign-troubling-turkish-companies/92836/

At least 80 companies based in Turkey have been dealing with an ongoing threat that is constantly evolving to become more persistent and dangerous. This massive phishing campaign was given the name “The Turkish Rat” by Sophos and Talos researchers, who have been following it for a while.
Researchers from Check Point now report that the same actors have added the ‘Adwind RAT’ into the mix. This multi-platform malware can establish remote access to the target system, as well as exfiltrate sensitive information from it.

The infection chain begins with the arrival of a phishing email which is accompanied by an Office attachment.
According to VirusTotal, only five out of 59 AV engines flag any of the above files as malicious.

The actor behind this campaign is using GitHub pages to host the malicious JAR files that are fetched by the email attachments, and frequently updates the repository to ensure that the campaign is “the latest and greatest.” In version 3.0, the Adwind RAT offers a comfortable and friendly user interface [...]
Click to expand...

The malware is automatically turning itself into a hidden file, making it even more difficult for the owners of the infected machines. Furthermore, it detects if it is running on a system emulator and plants a registry key on the Windows system for persistence.

One thing to note is that the malware also checks if the victim is in Turkey and if the system’s language is Turkish. If it does not detect those, the malware will not activate, which makes this campaign very specifically targeted at the moment.
Click to expand...

Check Point Research: “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign

Log in or Sign up

An Evolved ‘Adwind RAT’ Campaign is Troubling Companies

guest Guest

Log in or Sign up

An Evolved ‘Adwind RAT’ Campaign is Troubling Companies

guest Guest

Useful Searches