Threat actors cobble together open-source pieces into monstrous Frankenstein campaign

guest · Jun 4, 2019

Threat actors cobble together open-source pieces into monstrous Frankenstein campaign
June 4, 2019
https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html

Cisco Talos recently identified a series of documents that we believe are part of a coordinated series of cyber attacks that we are calling the "Frankenstein" campaign. We assess that the attackers carried out these operations between January and April 2019 in an effort to install malware on users' machines via malicious documents.
We assess that this activity was hyper-targeted given that there was a low volume of these documents in various malware repositories.

We believe that the threat actors behind the Frankenstein campaign are moderately sophisticated and highly resourceful.
Conclusion
The actors' preference for open-source solutions appears to be part of a broader trend in which adversaries are increasingly using publicly available tools, which offer them some advantages over a completely custom toolset.
This growing trend highlights that highly trained operators are increasingly using unsophisticated tools to accomplish their goals.
Click to expand...

The campaign used components of:

An article to detect when your sample is being run in a VM

A GitHub project that leverages MSbuild to execute a PowerShell command

A component of GitHub project called "Fruityc2" to build a stager

A GitHub project called "PowerShell Empire" for their agents

Click to expand...

Log in or Sign up

Threat actors cobble together open-source pieces into monstrous Frankenstein campaign

guest Guest

Log in or Sign up

Threat actors cobble together open-source pieces into monstrous Frankenstein campaign

guest Guest

Useful Searches