Lampion malware returns in new phishing attacks

guest · Sep 9, 2022

By Bill Toulas @billtoulas - September 9, 2022

The Lampion malware is being distributed in greater volumes lately, with threat actors abusing WeTransfer as part of their phishing campaigns.

WeTransfer is a legitimate file-sharing service that can be used free of charge, so it's a no-cost way to bypass security software that may not raise alerts about the URLs used in emails.
Click to expand...

In a new campaign observed by email security firm Cofense, Lampion operators are sending phishing emails from compromised company accounts urging users to download a "Proof of Payment" document from WeTransfer.
The file the targets receive is a ZIP archive containing a VBS (Virtual Basic script) file the victim needs to launch for the attack to begin.

The password for the ZIP files is hardcoded in the script, so the archives are extracted without requiring user interaction. The contained DLL payloads are loaded into memory, allowing Lampion to be stealthily executed on compromised systems.
Click to expand...

Lampion revitalized
The Lampion trojan has been around since at least 2019, focusing mainly on Spanish-speaking targets and using compromised servers to host its malicious ZIPs.

In 2021, Lampion was seen abusing cloud services for hosting the malware for the first time, including Google Drive and pCloud.
More recently, in March 2022, Cyware reported an uptick in the trojan's distribution, identifying a hostname link to Bazaar and LockBit operations.
Click to expand...

From there, Lampion begins stealing data from the computer, targeting bank accounts by fetching injections from the C2 and overlaying its own login forms on login pages. When users enter their credentials, these fake login forms will be stolen and sent to the attacker.
Click to expand...

Cofense: Lampion Trojan Utilizes New Delivery through Cloud-Based Sharing

By Andy Mann and Dylan Main - September 9, 2022
Analysts at the Cofense Phishing Defense Center (PDC) have recently analyzed an email asking users to download a “Proof of Payment” as well as other documents. While it is important to never click on the link(s) or download the attachment(s) of any suspicious email, if the recipient interacts with the link, it downloaded the malware Lampion.
Click to expand...

Log in or Sign up

Lampion malware returns in new phishing attacks

guest Guest

Log in or Sign up

Lampion malware returns in new phishing attacks

guest Guest

Useful Searches