MartyMcFly Malware: new Cyber-Espionage Campaign targeting Italian Naval Industry

guest · Oct 17, 2018

MartyMcFly Malware: new Cyber-Espionage Campaign targeting Italian Naval Industry
October 17, 2018
https://securityaffairs.co/wordpress/77195/malware/martymcfly-malware-cyber-espionage.html

Today I’d like to share an interesting analysis of a Targeted Attack found and dissected by Yoroi (technical details are available here). The victim was one of the most important leaders in the field of security and defensive military grade Naval ecosystem in Italy. Everything started from a well-crafted email targeting the right office asking for naval engine spare parts prices.

At a first sight, the office document had an encrypted content available [...] Using an encrypted payload is quite a common way to evade Antivirus

The Payload exploits CVE-2017-11882 by spawning the Equation Editor, dropping and executing an external PE file. [...]
Stage4 is pretty interesting per-se. [...] According to VirusTotal the software was “seen in the Wild” in 2010 but submitted only on 2018-10-12! This is pretty interesting, isn’t it?

Further details on the MartyMcFly malware are reported in the original analysis published by Marco Ramilli on his blog.
Click to expand...

EASTER · Oct 17, 2018

Where is the Doc when you need him? "That's heavy!"

Very enlightening article! Thanks

guest · Nov 14, 2018

The ‘MartyMcFly’ investigation: Italian naval industry under attack
November 14, 2018
https://securityaffairs.co/wordpress/78000/malware/the-martymcfly-investigation-2.html

Fincantieri who was not involved in the previous ‘MartyMcFly’ attack identified and blocked additional threats targeting their wide infrastructure intercepted on during the week of 20th August 2018, about a couple of months before the ‘MartyMcFly’ campaign.

Our task was to figure out if there were a correlation between those attacks targeting Italian Naval Industries and try to identify a possible attribution. [...]
Conclusion
The evidence collected during the joint analysis with the Fincantieri’s security team suggests some, still unspecified, targeted threat is likely trying to establish a foothold at least into the Italian naval industry.

At this time is not possible to confirm the two waves of attack have been planned and executed by the same threat actor of the “MartyMcFly” campaign, many differences such as the distinct type of payload are relevant
Click to expand...

Further details including IoC are available in the report published by Yoroi.
Click to expand...

Log in or Sign up

MartyMcFly Malware: new Cyber-Espionage Campaign targeting Italian Naval Industry

guest Guest

EASTER Registered Member

guest Guest

Log in or Sign up

MartyMcFly Malware: new Cyber-Espionage Campaign targeting Italian Naval Industry

guest Guest

EASTER Registered Member

guest Guest

Useful Searches