Croatian government targeted by mysterious hackers

guest · Jul 5, 2019

Croatian government targeted by mysterious hackers
Government agencies targeted with never before seen malware payload — named SilentTrinity
July 5, 2019
https://www.zdnet.com/article/croatian-government-targeted-by-mysterious-hackers/

Attackers, which are suspected to be a state-sponsored unit, have targeted victims using a spear-phishing campaign that mimicked delivery notifications from the Croatian postal or other retail services.
USERS TARGETED WITH NEVER-BEFORE-SEEN MALWARE
The document was laced with malicious code packed as a macro script which appeared to have been largely copied off the internet, from various tutorials or open source projects hosted on StackOverflow.com, Dummies.com, Issuu.com, Rastamouse.me, or GitHub.com.

The macro script, if enabled by the victim, would download and install malware on their systems. Two different sets of malware payloads were detected during these attacks.
The first was the Empire backdoor, a component of the Empire post-exploitation framework, a penetration testing utility. The second was SilentTrinity, another post-exploitation tool, similar to the first.
Click to expand...

In a report published today, Vishnyakov pointed out certain connections between the C&C servers used in this campaign targeting Croatian government agencies and past malware distribution operations.

While Vishnyakov refrained from attributing these attacks to a specific threat actor, the researcher did note that "the available data on hosts, addresses, and domains used-as well as the high number of connections between them-suggests a large-scale malicious effort."
Click to expand...

Positive Technologies: IronPython, darkly: how we uncovered an attack on government entities in Europe

Log in or Sign up

Croatian government targeted by mysterious hackers

guest Guest

Log in or Sign up

Croatian government targeted by mysterious hackers

guest Guest

Useful Searches