When You Unsubcribe to these Emails, You ‘Subscribe’ to the Loda RAT

guest · Apr 12, 2019

When You Unsubcribe to these Emails, You ‘Subscribe’ to the Loda RAT
April 11, 2019
https://cofense.com/unsubcribe-emails-subscribe-loda-rat/

Cofense Intelligence recently observed a campaign that used convincing emails to entice recipients into downloading a malicious document from a seemingly legitimate source.
This source URL downloaded a Microsoft Word document that abused an object relationship to then download and open an RTF document. The RTF document abused CVE-2017-11882 to download the multi-functional Loda Remote Access Trojan.

By taking advantage of users’ assumption that unsubscribe links are legitimate, along with their trust in verification, threat actors were able to craft a campaign capable of fooling even users with basic security awareness training.

If users are particularly security conscious, they might even look up the domain on a website with tools that check for legitimacy. However, this would likely give them the same information as what is shown in Figure 3, because most tools will check the root domain, in this case azurewebsites[.]net, which is a completely legitimate domain owned by Microsoft.
Click to expand...

Log in or Sign up

When You Unsubcribe to these Emails, You ‘Subscribe’ to the Loda RAT

guest Guest

Log in or Sign up

When You Unsubcribe to these Emails, You ‘Subscribe’ to the Loda RAT

guest Guest

Useful Searches