New Reconnaissance Tool Uses Code from Eight-Year-Old Comment Crew Implant

guest · Oct 18, 2018

New Reconnaissance Tool Uses Code from Eight-Year-Old Comment Crew Implant
October 18, 2018
https://www.bleepingcomputer.com/ne...ode-from-eight-year-old-comment-crew-implant/

A newly discovered first-stage implant targeting Korean-speaking victims borrows code from another reconnaissance tool linked to Comment Crew, a Chinese nation-state threat actor that was exposed in 2013 following cyber espionage campaigns against the United States.

Dubbed Oceansalt, the threat has been spotted on machines in South Korea, the United States, and Canada.

The adversary used spear phishing to lure victims into opening Microsoft Excel and Word documents with content in Korean, specially crafted to download the malware.

They suspect financial theft as a possible motivation for the attack, and that it was intended as a precursor to a huge compromise because Oceansalt would give its operator full control of the infected systems and the networks they connected to.
Click to expand...

Log in or Sign up

New Reconnaissance Tool Uses Code from Eight-Year-Old Comment Crew Implant

guest Guest

Log in or Sign up

New Reconnaissance Tool Uses Code from Eight-Year-Old Comment Crew Implant

guest Guest

Useful Searches