Global hacking campaign takes aim at finance, defence and energy companies

guest · Dec 12, 2018

Global hacking campaign takes aim at finance, defence and energy companies
December 12, 2018
https://www.zdnet.com/article/globa...-aim-at-finance-defence-and-energy-companies/

Dubbed Operation Sharpshooter by researchers at McAfee, the new campaign has only been active for a matter of weeks, but hit 87 organisations in 24 countries during October and November alone, with the aim of the operation seemingly being intelligence gathering.

Researchers note that the attacks display many of the hallmarks of the Lazarus Group, a hacking group working on behalf of the interests of North Korea -- but say that alone isn't enough to confirm attribution.

The operation began on October 25, with a series of phishing emails [...]
The documents contain a malicious macro that leverages embedded shellcode to inject a downloader for the Sharpshooter malware into the memory of Word. This then serves as a downloader for the second stage of the campaign: implanting Rising Sun.

Rising Sun is a modular backdoor that performs reconnaissance on the victim's network, [...] The malware can also execute various commands, get additional files and is capable of clearing memory and deleting activity.
Click to expand...

guest · Apr 4, 2019

The Social Engineering Behind Operation Sharpshooter, Rising Sun
April 3, 2019
https://www.bromium.com/social-engineering-operation-sharpshooter-rising-sun/

Everyone is overloaded, at work and with our personal lives, and important things sometimes slip through the cracks. Panic sets in when we think we missed a payment and our mind races: Did I overlook an email?
Since clicking a links seems safer than opening an attachment, many users see little risk and succumb to the “overload” hack. They click the link. Strike one.

Unfortunately, this link leads directly to a weaponized document. The user is already committed to figuring out what bill was missed. Since the file was not blocked, then it must be OK?
Now the document is opened. Strike two.
Maybe my Office Suite Is out of date?
If a user has already “invested” two clicks into this process, s/he is not likely to be deterred from the third and most deadly click: enabling active content. [...] Strike three
Word promptly launches the Command Prompt, then downloads and runs a malicious executable.
Click to expand...

The thing is, this isn’t a bug, an exploit, or a Zero-day attack. It’s simple, garden-variety social engineering, preying on busy users and “living off the land” using built-in features of the Microsoft Office Suite.

Once they gain a foothold on a single machine, the attacker is free to download additional malware, escalate privileges, steal credentials, and move laterally within the organization.
Click to expand...

Log in or Sign up

Global hacking campaign takes aim at finance, defence and energy companies

guest Guest

guest Guest

Log in or Sign up

Global hacking campaign takes aim at finance, defence and energy companies

guest Guest

guest Guest

Useful Searches