Malicious actor Sweed puts new spins on its attacks

guest · Jul 16, 2019

Malicious actor Sweed puts new spins on its attacks
July 16, 2019
https://www.scmagazine.com/home/sec...us-actor-sweed-puts-new-spins-on-its-attacks/

A threat actor named Sweed who has been active for more than two years using spearphishing emails with malicious attachments to spread Formbook, Lokibot and Agent Tesla has been given a detailed examination by Cisco Talos.
Cisco Talos researcher Edmund Brumaghin said for the most part Agent Tesla is the group’s favorite flavor of malware, but noted Sweed has used a variety of delivery methods since 2017.

Talos was also able to identify an actor on several forums that went by Sweed or Swee D, and actively interacted with that person. The individual claimed to be an ethical hacker, but further investigating found a person with the same name in a forum working with stolen credit card information.

“Based on the TTPs used by this group, SWEED should be considered a relatively amateur actor. They use well-known vulnerabilities, commodity stealers and RATs (Pony, Formbook, UnknownRAT, Agent Tesla, etc.) and appear to rely on kits readily available on hacking forums. [...]"
Click to expand...

Cisco Talos: SWEED: Exposing years of Agent Tesla campaigns

guest · Oct 31, 2019

Phishing Campaign Targets Precision Engineering Company
October 31, 2019
https://www.bleepingcomputer.com/ne...mpaign-targets-precision-engineering-company/

Attackers have targeted precision companies in Italy with phishing that is difficult to spot. The final payload is a fileless trojan that harvests credentials.
The campaign used a legitimate-looking Microsoft Excel spreadsheet embedded with exploit code that moves silently to infect the computer.
The exploit
Unlike the run-of-the-mill methods of infection that involve a Microsoft Office document, the cybercriminals behind this campaign did not embed malicious macro code in the Excel file, which would call for user interaction.

Instead, they opted for a stealthier variant: an exploit for a remote code execution security bug that would run automatically run code on the victim computer without user intervention as soon as the document was opened.
The vulnerability is an old one (CVE-2017-11882) in the Equation Editor component of Microsoft Office software [...]
Click to expand...

Data collected from the victim computer is pushed to a command and control server located at 'corpcougar.com.' Coincidentally or not, that server also hosts a phishing kit for Microsoft services. The fake login page imitates the original pretty well but a closer look at the links at the bottom reveals its true colors.
Ramilli believes that these spearphishing attacks are the work of a threat actor called 'SWEED,' known for using info-stealing malware like LokiBot, Agent Tesla, and Formbook, previously documented by Cisco Talos researchers.
Click to expand...

Marco Ramilli: SWEED Targeting Precision Engineering Companies in Italy

Log in or Sign up

Malicious actor Sweed puts new spins on its attacks

guest Guest

guest Guest

Log in or Sign up

Malicious actor Sweed puts new spins on its attacks

guest Guest

guest Guest

Useful Searches