Autumn Aperture: Threat Campaign Highlights New Evasion Technique using an Antiquated File Format

guest · Sep 12, 2019

Autumn Aperture: Threat Campaign Highlights New Evasion Technique using an Antiquated File Format
September 11, 2019
https://blog.prevailion.com/2019/09/autumn-aperture-report.html

In what is assessed to be an expansion of a coordinated effort to target U.S.-based entities, an emerging and increasingly sophisticated campaign employing obscure file formats poses significant risk — and highlights the need for vigilance around third-party relations.
We have dubbed the campaign “Autumn Aperture” and have associated it — with moderate confidence — to the Kimsuky, a.k.a. “Smoke Screen”, threat actors.

To increase the effectiveness of their campaign, the threat actors obtained documents written by industry experts.
This campaign also denoted an evolution in the threat actors’ techniques, as they shifted to more obscure file formats (Kodak FlashPix), resulting in a significantly lower detection rate by anti-virus (AV) products.

We hypothesize that these documents, sent via a socially engineered email, would have likely been anticipated by the intended victims, thus increasing the threat actors’ chance of success.
Click to expand...

According to VirusTotal testing, the FPX file format has a significantly lower dectection rate, dropping the initial detection rate to 8/57 AV products. Whereas the standard file format, VBA, had an initial detection rate of 23/57.
Click to expand...

Log in or Sign up

Autumn Aperture: Threat Campaign Highlights New Evasion Technique using an Antiquated File Format

guest Guest

Log in or Sign up

Autumn Aperture: Threat Campaign Highlights New Evasion Technique using an Antiquated File Format

guest Guest

Useful Searches