Malware Attack on Aviation Industry uncovered

guest · Sep 22, 2021

Hackers Attack Aviation Industry With AsyncRAT to Steal Login Credentials
September 21, 2021
https://gbhackers.com/hackers-attack-aviation-industry-with-asyncrat/

Cisco Talos has detected and published a series of malicious campaigns recently along with many other security researchers that are continuously targeting the aviation industry.

This campaign is continuously targeting the aerospace and travel sectors along with spear-phishing emails that spread an actively exploited loader, and later it also delivers RevengeRAT or AsyncRAT.
The main motive of the threat actors is to steal the credentials and cookies, which the attacker can contribute to more technically savvy cybercriminals.
Click to expand...

Aviation campaign
After detecting the campaign, the security analysts took it very seriously after a tweet from Microsoft describing new attacks that they have detected using AsyncRAT.

The co-Founder, and CTO of BreachQuest, Jake Williams said:-

“The cookies and credentials might be the main “gets” for now, there’s an opening for worse attacks down the line in this kind of campaign.”
Click to expand...

Cisco Talos: Operation Layover: How we tracked an attack on the aviation industry to five years of compromise

Cisco Talos linked the recent aviation targeting campaigns to an actor who has been targeting the aviation industry for two years.

The same actor has been running successful malware campaigns for more than five years.

Although always using commodity malware, the acquisition of crypters to wrap the malware makes them more effective.

This shows that a small operation can run for years under the radar, while still causing serious problems for its targets.

Click to expand...

We believe the actor is based out of Nigeria with a high degree of confidence and doesn't seem to be technically sophisticated, using off-the-shelf malware since the beginning of its activities without developing its own malware. The actor also buys the crypters that allow the usage of such malware without being detected, throughout the years it has used several different cryptors, mostly bought on online forums.

We also believe with a high degree of confidence that the actor has been active for at least five years.
Click to expand...

In this post, we will show how our research uncovered information about the attackers spreading AsyncRAT and njRAT using specific lure documents centered around the aviation industry. If infected with these threats, organizations could fall victim to data theft, financial fraud or future cyber attacks with much worse consequences.
Click to expand...

Log in or Sign up

Malware Attack on Aviation Industry uncovered

guest Guest

Log in or Sign up

Malware Attack on Aviation Industry uncovered

guest Guest

Useful Searches