Norton LifeLock Phishing Scam Installs Remote Access Trojan

guest · Feb 27, 2020

Norton LifeLock Phishing Scam Installs Remote Access Trojan
February 27, 2020
https://www.bleepingcomputer.com/ne...-phishing-scam-installs-remote-access-trojan/

Cybercriminals behind a recently observed phishing campaign used a clever ruse in the form of a bogus NortonLifelock document to fool victims into installing a remote access tool (RAT) that is typically used for legitimate purposes.
The malicious activity has the hallmarks of a seasoned threat actor familiar with evasion techniques and offensive security frameworks that help install the payload.
Hooking the victim
The infection chain starts with a Microsoft Word document laced with malicious macro code.

Under the pretext of a password-protected NortonLifelock document with personal information, victims are asked to enable macros and type in a password that is most likely provided in the phishing email.
Evasion and persistence
If the user provides the correct input, the macro keeps executing and builds a command string that ultimately installs NetSupport Manager, a legitimate remote control software.
Click to expand...

In a report today, the researchers note that the MSI payload retrieved this way installs without any warning to the user and adds a PowerShell script in the Windows %temp% folder.

It is used for persistence, its role is that of a backup solution for installing the NetSupport Manager remote access tool. Before proceeding, the script checks for the presence of Avast or AVG antivirus and stops if any of the two are running on the victim host.
Palo Alto Networks published on its GitHub page a set of indicators of compromise associated with this threat actor's campaign.
Click to expand...

Palo Alto Networks - Unit42: Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT

In January 2020, Unit 42 identified a malicious Microsoft Word document, disguised as a password-protected NortonLifelock document, being used in a phishing campaign to deliver a commercially available remote access tool (RAT) called NetSupport Manager. Using a fictitious NortonLifelock document to entice the user to enable macros makes this particular attack interesting to us.
Click to expand...

Log in or Sign up

Norton LifeLock Phishing Scam Installs Remote Access Trojan

guest Guest

Log in or Sign up

Norton LifeLock Phishing Scam Installs Remote Access Trojan

guest Guest

Useful Searches