Threat actorhigh
New campaign uses government, union-themed lures to deliver Cobalt Strike beacons
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files | 7.8 | 99% | KEVRansomwarePoC ×6 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bitbucket.org | malicious Word document contains an embedded URL, https[://]bitbucket[.]org/atlasover/atlassiancore/downloads/EmmaJardi.dotm, within |
| ipv4 | 1.1.1.1 | downloader also executes the ping command to the IP address 1[.]1[.]1[.]1 and executes the delete command to delete itself. The |
| ipv4 | 185.225.73.238 | the C2 server operated in this campaign with the IP address 185[.]225[.]73[.]238 running on Ubuntu Linux version 18.04, located in the |
| ipv4 | 43.154.175.230 | sclosed another Cobalt Strike C2 server with the IP address 43[.]154[.]175[.]230 running on Ubuntu Linux version 18.04 located in Hong |
| sha256 | 0be8a6ef98747e0efd13917d93bf0999b728588b29f4e24d3ee23e26314a1a1a | 8be6c714e8dcce8f0fc9c2dce8b3d1f22fee9246089dbbbe1046aed8c03 0be8a6ef98747e0efd13917d93bf0999b728588b29f4e24d3ee23e26314a1a1a Downloader EXE 254f866241e09be7d4d7490ce9c6347ed2c671d0eac4 |
| sha256 | 15fdad64484543b204ca76537542b6cf42b4b6fb9856692c8bf691648d647d88 | 95c51eb561ce0e7dc6594fc60702371d5e1ac97c4c1255def8e4084ef08 15fdad64484543b204ca76537542b6cf42b4b6fb9856692c8bf691648d647d88 72be84fe73565209958183176cb9abd44d8e6d862f234105ed5673c171d |
| sha256 | 254f866241e09be7d4d7490ce9c6347ed2c671d0eac4f9d3c67155c37de3af07 | 917d93bf0999b728588b29f4e24d3ee23e26314a1a1a Downloader EXE 254f866241e09be7d4d7490ce9c6347ed2c671d0eac4f9d3c67155c37de3af07 Redline Stealer ec1e1d45162b92fbe2811c16da830186a558d4cd8af |
| sha256 | 5f344c80096e18a98b6acd77482886f402cfbccb90d922d03aac07d1ae6261af | 92fbe2811c16da830186a558d4cd8af52620f37c440bbd763013 Amadey 5f344c80096e18a98b6acd77482886f402cfbccb90d922d03aac07d1ae6261af |
| sha256 | 6d9c595c51eb561ce0e7dc6594fc60702371d5e1ac97c4c1255def8e4084ef08 | ket.org/clouchfair/oneproject/downloads/strymon.png Maldocs 6d9c595c51eb561ce0e7dc6594fc60702371d5e1ac97c4c1255def8e4084ef08 15fdad64484543b204ca76537542b6cf42b4b6fb9856692c8bf691648d6 |
| sha256 | 718e55af05f48101eac7fb07767dba56a26651f8ed14f1c88058e1902d3d9dd5 | 565209958183176cb9abd44d8e6d862f234105ed5673c171de5991 DOTM 718e55af05f48101eac7fb07767dba56a26651f8ed14f1c88058e1902d3d9dd5 abafb5ae3f8d730acd06389320353631cbe5bc02064561851468301aa0e |
| sha256 | 72be84fe73565209958183176cb9abd44d8e6d862f234105ed5673c171de5991 | d64484543b204ca76537542b6cf42b4b6fb9856692c8bf691648d647d88 72be84fe73565209958183176cb9abd44d8e6d862f234105ed5673c171de5991 DOTM 718e55af05f48101eac7fb07767dba56a26651f8ed14f1c88058e1 |
| sha256 | abafb5ae3f8d730acd06389320353631cbe5bc02064561851468301aa0ee9ce1 | 5af05f48101eac7fb07767dba56a26651f8ed14f1c88058e1902d3d9dd5 abafb5ae3f8d730acd06389320353631cbe5bc02064561851468301aa0ee9ce1 Cobalt Strike d7c23a85bbd337bdeba63ce50cd64fa56bd08ca5631b2 |
| sha256 | c6a948be6c714e8dcce8f0fc9c2dce8b3d1f22fee9246089dbbbe1046aed8c03 | 23173c272fee9626adffdb7d4336b299316b5dd9115fdb8674b94384d89 c6a948be6c714e8dcce8f0fc9c2dce8b3d1f22fee9246089dbbbe1046aed8c03 0be8a6ef98747e0efd13917d93bf0999b728588b29f4e24d3ee23e26314 |
| sha256 | d7c23a85bbd337bdeba63ce50cd64fa56bd08ca5631b29211e0446c77eb69f9e | 6389320353631cbe5bc02064561851468301aa0ee9ce1 Cobalt Strike d7c23a85bbd337bdeba63ce50cd64fa56bd08ca5631b29211e0446c77eb69f9e fa53323173c272fee9626adffdb7d4336b299316b5dd9115fdb8674b943 |
| sha256 | ec1e1d45162b92fbe2811c16da830186a558d4cd8af52620f37c440bbd763013 | 90ce9c6347ed2c671d0eac4f9d3c67155c37de3af07 Redline Stealer ec1e1d45162b92fbe2811c16da830186a558d4cd8af52620f37c440bbd763013 Amadey 5f344c80096e18a98b6acd77482886f402cfbccb90d922d03aac |
| sha256 | fa53323173c272fee9626adffdb7d4336b299316b5dd9115fdb8674b94384d89 | a85bbd337bdeba63ce50cd64fa56bd08ca5631b29211e0446c77eb69f9e fa53323173c272fee9626adffdb7d4336b299316b5dd9115fdb8674b94384d89 c6a948be6c714e8dcce8f0fc9c2dce8b3d1f22fee9246089dbbbe1046ae |
From the original article
9 min read at blog.talosintelligence.com
Cisco Talos discovered a malicious campaign in August 2022 delivering Cobalt Strike beacons that could be used in later, follow-on attacks. Lure themes in the phishing documents in this campaign are related to the job details of a government organization in the United States and a trade union in New Zealand. The attack involves a multistage and modular infection chain with fileless, malicious scripts.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.