Novel Email-Based Campaign Targets Bloomberg Clients with RATs

guest · Apr 22, 2021

Novel Email-Based Campaign Targets Bloomberg Clients with RATs
April 21, 2021
https://threatpost.com/email-campaign-targets-bloomberg-clients/165514/

Attacks dubbed ‘Fajan’ by researchers are specifically targeted and appear to be testing various threat techniques to find ones with the greatest impact.

Cisco Talos Intelligence researchers discovered the campaign, dubbing it and its perpetrator “Fajan,” and asserting it is likely the work of one actor from an Arabic-speaking country.
Click to expand...

Researchers have been tracking the email based campaign since Fajan first commenced activity in March, recovering a “relatively low volume” of samples that make it tricky to determine “whether the campaigns are carefully targeted or mass-spammed,” according to a report posted online Wednesday.

Svajcer goes into detailed analysis of the attack based on the Fajan samples researchers observed. If lightly obfuscated VBA macro code is found in the malicious document “it is usually to drop and execute a Javascript or a VB script based payload,” he wrote.
These “are rather simple RATs that connect to a hardcoded IP address and listen to commands sent using HTTP over a non-standard TCP port number,” Svajcer wrote.
Click to expand...

Log in or Sign up

Novel Email-Based Campaign Targets Bloomberg Clients with RATs

guest Guest

Log in or Sign up

Novel Email-Based Campaign Targets Bloomberg Clients with RATs

guest Guest

Useful Searches