New Hawkball backdoor attacks government sector in Central Asia

guest · Jun 7, 2019

New Hawkball backdoor attacks government sector in Central Asia
June 7, 2019
https://www.scmagazine.com/home/sec...or-attacks-government-sector-in-central-asia/

A newly discovered malicious backdoor by the name of Hawkball was recently observed in a campaign apparently targeting one or more Russian-speaking government entities in Central Asia, according to a blog post this week from FireEye Labs.

Upon successful infection, Hawkball offers the unidentified attackers a range of malicious capabilities, writes FireEye blog post author and malware researcher Swapnil Patil. These include surveying the host and collecting victim information; delivering additional payloads; creating a named pipe to execute native Windows commands; terminating processes; creating, deleting and uploading files; and enumerating drives.

Opening the malicious file commences an infection chain that delivers the payload via two previously patched Microsoft Office memory corruption vulnerabilities – CVE-2017-11882 [...] and CVE-2018-0802
Click to expand...

Log in or Sign up

New Hawkball backdoor attacks government sector in Central Asia

guest Guest

Log in or Sign up

New Hawkball backdoor attacks government sector in Central Asia

guest Guest

Useful Searches