Threat Actors Distribute Seldom Observed Bandook Malware

guest · Jul 21, 2021

Spanish Users Targeted by Novel Campaign Using an Old Malware Strain
July 20, 2021
https://www.technadu.com/spanish-users-targeted-novel-campaign-using-old-malware-strain/290556/

A group of actors is targeting Spanish-speaking users with a 14-years old malware strain.

The emails used in the campaign pretend to carry financial documents from South American companies.

The actors are deploying the RAT to steal sensitive information like user account credentials.

Click to expand...

There’s a mass malware distribution campaign going on right now, spreading an old strain called “Bandook” to Spanish-speaking users. The group responsible for this is TA2721 (“Caliente Bandits”), tracked identified by Proofpoint researchers, and while the sophistication of their operations isn’t very high, the scale and activity are impressive. In most cases, the actors masqueraded as companies located in a South American company, sending financial-related emails to the targets.

The infection chain starts with the arrival of a PDF document via email, with a malicious URL contained in the file. If clicked, a redirection circle begins leading to the download of an encrypted RAR file is delivered onto the recipient’s system. Then, that file unpacks and installs the Bandook RAT locally.
Click to expand...

The use of Bandook is a rare occurrence in the malware distribution world, as this is a RAT first seen in the wild in 2007, so it’s considered pretty obsolete at this point.

However, it is worth noting that Bandook was never entirely gone from the cyberthreat space. Last year, we saw it being distributed globally again through macro-ridden documents arriving via email. It is a publicly available malware, so it’s easy to source and deploy, even if passing it through AV protections is a hopeless procedure for the actors that choose to use it.
Click to expand...

Proofpoint: New Threat Actor Uses Spanish Language Lures to Distribute Seldom Observed Bandook Malware

Key Findings 

Proofpoint researchers identified a new group, TA2721 distributing Spanish-language email threats.

The group often targets individuals with Spanish-language surnames at global organizations representing multiple different industries.

The infection chain features a PDF containing a URL that leads to an encrypted RAR file which installs Bandook malware.

The threat actor tends to use the same command and control (C2) infrastructure for weeks or months at a time. Proofpoint has only seen three different C2 domains in the last six months.

Bandook is an old malware that is not used by many threat actors.

Click to expand...

Log in or Sign up

Threat Actors Distribute Seldom Observed Bandook Malware

guest Guest

Log in or Sign up

Threat Actors Distribute Seldom Observed Bandook Malware

guest Guest

Useful Searches