New attack tied to Higaisa APT discovered

guest · Jun 5, 2020

Spear-Phishing Campaign Hits Developer Collaboration System Users
Users of Zeplin, a popular developer and designer collaboration system, have been hit with new waves of spear-phishing attacks
June 5, 2020
https://www.darkreading.com/applica...er-collaboration-system-users-/d/d-id/1338012

A sophisticated spear-phishing campaign has targeted companies using Zeplin, a collaboration system heavily used in the software development and product design communities. The campaign, launched in early May by South Korean APT group Higaisa, took special aim at newer users of the service, luring users with files purporting to be a project file and updates to copyright policies.

The Prevailion Tailored Intelligence Team, which discovered the campaign, notes in its published report that the malware used indicates that it originated with an experienced, technologically sophisticated organization.
Among the factors leading to that conclusion are multiple program storage locations on the victim computer, multiple command-and-control servers, and the ability to communicate over multiple networking protocols.
Click to expand...

Prevailion: The Gh0st Remains the Same

Prevailion’s Tailored Intelligence Team has detected a new advanced campaign dubbed - “The Gh0st Remains the Same.”
This first campaign likely commenced between May 11th and 12th, 2020. In this engagement, the victims received a compressed RAR folder that contained trojanized files. If the malicious files were engaged, they displayed decoy web pages associated with the software company “Zeplin”.

Furthermore, we observed a subsequent campaign employing the same infection process, that commenced on 30 May 2020. This particular campaign differed in its use of a trojanized Curriculum Vitae (CV) impersonating a college student named “Wang Lei” from Hong Kong, and the use of a hard-coded IP address in lieu of a threat actor controlled domain.
Click to expand...

Malwarebytes: New LNK attack tied to Higaisa APT discovered

On May 29th, we identified an attack that we believe is part of a new campaign from an Advanced Persistent Threat actor known as Higaisa. The Higaisa APT is believed to be tied to the Korean peninsula, and was first disclosed by Tencent Security Threat Intelligence Center in early 2019.
The group’s activities go back to at least 2016 and include the use of Trojans such as Gh0st and PlugX, as well as mobile malware.

In this latest incident, Higaisa used a malicious shortcut file ultimately responsible for creating a multi-stage attack that consists of several malicious scripts, payloads and decoy PDF documents.
Click to expand...

Log in or Sign up

New attack tied to Higaisa APT discovered

guest Guest

Log in or Sign up

New attack tied to Higaisa APT discovered

guest Guest

Useful Searches