Ransomwarecritical
Decoy Microsoft Word Documents Used to Deliver Nim
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-36025 | Windows SmartScreen Bypass (CVE-2023-36025) Exploited via Crafted Shortcut Files | 8.8 | 88% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dns.govnp.org | [.]govnp[.]org nitc[.]govnp[.]org mx1[.]nepal[.]govnp[.]org dns[.]govnp[.]org "Nim is a statically typed compiled programming languag |
| domain | mail.mofa.govnp.org | command-and-control (C2) servers are no longer accessible - mail[.]mofa[.]govnp[.]org nitc[.]govnp[.]org mx1[.]nepal[.]govnp[.]org dns[.]go |
| domain | mx1.nepal.govnp.org | r accessible - mail[.]mofa[.]govnp[.]org nitc[.]govnp[.]org mx1[.]nepal[.]govnp[.]org dns[.]govnp[.]org "Nim is a statically typed compiled |
| domain | nitc.govnp.org | ervers are no longer accessible - mail[.]mofa[.]govnp[.]org nitc[.]govnp[.]org mx1[.]nepal[.]govnp[.]org dns[.]govnp[.]org "Nim is a s |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Dec 22, 2023 Social Engineering / Malware Analysis A new phishing campaign is leveraging decoy Microsoft Word documents as bait to deliver a backdoor written in the Nim programming language .
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.