OceanLotus ATP group uses new Kerrdown downloader to deliver payloads

guest · Feb 1, 2019

OceanLotus ATP group uses new Kerrdown downloader to deliver payloads
February 1, 2019
https://www.scmagazine.com/home/sec...-new-kerrdown-downloader-to-deliver-payloads/

Researchers have discovered a previously unknown custom downloader family that reputed Vietnamese APT group OceanLotus has been using since at least early 2018 to infect victims with payloads such as Cobalt Strike Beacon.

Palo Alto Networks’ Unit 42 division said in a company blog post today that its researchers observed a “high number of samples,” of the DLL downloader – enough to determine that the attackers operated during typical Vietnamese working hours.

Kerrdown infections occur one of two known methods, both of which involve phishing emails with content or file names written in Vietnamese. The first delivery leverages Microsoft Office documents with malicious macros while the second relies on RAR archives containing a legitimate program with DLL side-loading capabilities.
Click to expand...

Log in or Sign up

OceanLotus ATP group uses new Kerrdown downloader to deliver payloads

guest Guest

Log in or Sign up

OceanLotus ATP group uses new Kerrdown downloader to deliver payloads

guest Guest

Useful Searches