Phishing Campaigns Ship New SideTwist Backdoor and Agent Tesla Variant

[ad_1]

Sep 06, 2023THNCyber Menace / Malware

The Iranian menace actor tracked as APT34 has been linked to a brand new phishing assault that results in the deployment of a variant of a backdoor referred to as SideTwist.

“APT34 has a excessive stage of assault expertise, can design completely different intrusion strategies for various kinds of targets, and has provide chain assault functionality,” NSFOCUS Safety Labs stated in a report printed final week.

APT34, additionally identified by the names Cobalt Gypsy, Hazel Sandstorm (previously Europium), Helix Kitten, and OilRig, has a observe file of concentrating on telecommunications, authorities, protection, oil and monetary companies verticals within the Center East since at the very least 2014 through spear-phishing lures that culminate within the deployment of varied backdoors.

One of many key traits of the hacking outfit is its potential to create new and up to date instruments to attenuate the percentages of detection and achieve a foothold on compromised hosts for prolonged intervals of time.

SideTwist was first documented as utilized by APT34 in April 2021, with Verify Level describing it as an implant able to file obtain/add and command execution.

The assault chain recognized by NSFOCUS begins with a bait Microsoft Phrase doc that embeds inside a malicious macro, which, in flip, extracts and launches the Base64-encoded payload saved within the file.

The payload is a variant of SideTwist that is compiled utilizing GCC and establishes communication with a distant server (11.0.188(.)38) to obtain additional instructions.

The event comes as Fortinet FortiGuard Labs captured a phishing marketing campaign that spreads a brand new Agent Tesla variant utilizing a specifically crafted Microsoft Excel doc that exploits CVE-2017-11882, a six-year-old reminiscence corruption vulnerability in Microsoft Workplace’s Equation Editor, and CVE-2018-0802.

UPCOMING WEBINAR

Approach Too Susceptible: Uncovering the State of the Identification Assault Floor

Achieved MFA? PAM? Service account safety? Learn how well-equipped your group really is towards identification threats

Supercharge Your Expertise

“The Agent Tesla core module collects delicate data from the sufferer’s gadget,” safety researcher Xiaopeng Zhang stated. “This data consists of the saved credentials of some software program, the sufferer’s keylogging data, and screenshots.”

In keeping with knowledge shared by cybersecurity agency Qualys, CVE-2017-11882 stays one of many most favored flaws to this point, exploited by “467 malware, 53 menace actors, and 14 ransomware” as just lately as August 31, 2023.

It additionally follows the discovery of one other phishing assault that has been discovered to make use of ISO picture file lures to launch malware strains similar to Agent Tesla, LimeRAT, and Remcos RAT on contaminated hosts.

Discovered this text fascinating? Comply with us on Twitter  and LinkedIn to learn extra unique content material we publish.


[ad_2]

Supply hyperlink