Threat actorhigh
SWEED: Exposing years of Agent Tesla campaigns
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-8759 | Remote Code Execution in Microsoft .NET Framework via Malicious Documents (CWE-94) | 7.8 | 89% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aelna.com | g malicious content associated with these campaigns: hxxp://aelna[.]com/file/ chuks .exe hxxp://aelna[.]com/file/ sweed .exe hxxp |
| domain | comie.ru | ntified several panel with the following URLs: sweed-office.comie[.]ru/ goodman /panel sweed-office.comie[.]ru/ kc /panel/ wlttr |
| domain | duckdns.org | counts: sweedoffice[.]duckdns[.]org sweedoffice- olamide [.]duckdns[.]org sweedoffice- chuks [.]duckdns[.]org www.sweedoffice- kc . |
| domain | sodimodisfrance.cf | ample listing below using the domain sodismodisfrance[.]cf: sodimodisfrance[.]cf/2/ chuks .exe sodimodisfrance[.]cf/6/ chuks .exe sodimodi |
| domain | sodismodisfrance.cf | malicious files, an example listing below using the domain sodismodisfrance[.]cf: sodimodisfrance[.]cf/2/ chuks .exe sodimodisfrance[.]cf/ |
| domain | sweeddehacklord.us | xfiltrate sensitive information collected by Agent Tesla is sweeddehacklord[.]us. Analysis of known malware seen communicating with this d |
| domain | sweedoffice.duckdns.org | t feature many of the same values as the RDP user accounts: sweedoffice[.]duckdns[.]org sweedoffice- olamide [.]duckdns[.]org sweedoffice- chuk |
| domain | sweed-viki.ru | rver, as well. sweeddehacklord[.]us sweed-office.comie[.]ru sweed-viki[.]ru Use of typosquatting Another interesting element of many |
| domain | wlttraco.com | ie[.]ru/ goodman /panel sweed-office.comie[.]ru/ kc /panel/ wlttraco[.]com/sweed-office/ omee /panel/login.php wlttraco[.]com/sweed- |
| ipv4 | 84.38.134.121 | P server believed to have been actively leveraged by SWEED (84.38.134[.]121): In the screenshot above, the list of user accounts esta |
| sha256 | 59b15f6ace090d05ac5f7692ef834433d8504352a7f45e80e7feb05298d9c2dd | ns conducted by this group. Campaign #1 Java_Updater.zip -> 59b15f6ace090d05ac5f7692ef834433d8504352a7f45e80e7feb05298d9c2dd P-O of Jun2017.zip -> e397ba1674a6dc470281c0c83acd70fd4d772 |
| sha256 | 65bdd250aa4b4809edc32faeba2781864a3fee7e53e1f768b35a2bdedbb1243b | 006f6849b246a97 Campaign #3 New Order For Quotation.ppsx -> 65bdd250aa4b4809edc32faeba2781864a3fee7e53e1f768b35a2bdedbb1243b Campaign #4 SETTLEMENT OF OUTSTANDING.xlsx ->… |
| sha256 | 8c8f755b427b32e3eb528f5b59805b1532af3f627d690603ac12bf924289f36f | 81c0c83acd70fd4d772bf8dcf23bf2c692db6575f6ab08 Agent Tesla: 8c8f755b427b32e3eb528f5b59805b1532af3f627d690603ac12bf924289f36f Campaign #2 Java sample=> d27a29bdb0492b25bf71e536c8a1fae83 |
| sha256 | d27a29bdb0492b25bf71e536c8a1fae8373a4b57f01ad7481006f6849b246a97 | 532af3f627d690603ac12bf924289f36f Campaign #2 Java sample=> d27a29bdb0492b25bf71e536c8a1fae8373a4b57f01ad7481006f6849b246a97 Campaign #3 New Order For Quotation.ppsx -> 65bdd250aa4b480 |
| sha256 | e397ba1674a6dc470281c0c83acd70fd4d772bf8dcf23bf2c692db6575f6ab08 | 34433d8504352a7f45e80e7feb05298d9c2dd P-O of Jun2017.zip -> e397ba1674a6dc470281c0c83acd70fd4d772bf8dcf23bf2c692db6575f6ab08 Agent Tesla: 8c8f755b427b32e3eb528f5b59805b1532af3f627d6906 |
| url | http://aelna.com/file/ | hosting malicious content associated with these campaigns: hxxp://aelna[.]com/file/ chuks .exe hxxp://aelna[.]com/file/ sweed .exe hxxp://ael |
From the original article
13 min read at blog.talosintelligence.com
Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor we're calling "SWEED," including such notable malware as Formbook, Lokibot and Agent Tesla. Based on our research, SWEED — which has been operating since at least 2017 — primarily targets their victims with stealers and remote access trojans.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.