"Blank Slate" Campaign Takes Advantage of Hosting Providers to Spread Ransomware
Unit 42 profiles the Blank Slate malspam campaign: blank emails with double-zipped attachments delivering Cerber ransomware while cycling abused hosting provider domains.
The Blank Slate campaign sends empty emails containing double-zipped archives with macro-enabled Word documents or JavaScript files that launch PowerShell to download ransomware, primarily Cerber, and occasionally Sage 2.0 or Locky. Unit 42 observed 555 campaign domains over seven months, with actors repeatedly registering new domains and cycling abuse of legitimate hosting providers after takedowns. In a five-day January-February 2017 window, at least eight domains across seven IP addresses were observed hosting Cerber payloads.
- Blank emails carry double-zipped Word or .js files to evade antispam technologies
- Macros or JavaScript launch PowerShell to fetch Cerber, Sage 2.0, or Locky ransomware
- 555 domains used over seven months, quickly replaced with new registrations after takedowns
- Eight domains across seven IP addresses hosted Cerber during a five-day observation window
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 User Execution: Malicious FileT1059.001 PowerShellT1105 Ingress Tool TransferT1486 Data Encrypted for Impact
- Vendors
- Palo Alto Networks
- Products
- AutoFocus
- Threat actors
- Blank Slate
- Organizations
- Palo Alto Networks
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adibas.top | ollowing list shows each domain followed by its IP address. adibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergo |
| domain | astrovoerta.top | iuj[.]top - 46.173.219.161 suzemodels[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofelaseo[.]top - 35.163.101.72 These do |
| domain | footarepu.top | n followed by its IP address. adibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163.101.72 gunterg |
| domain | guntergoner.top | ibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163.101.72 guntergoner[.]top - 185.159.130.89 ibm-te |
| domain | ibm-technoligi.top | er[.]top - 35.163.101.72 guntergoner[.]top - 185.159.130.89 ibm-technoligi[.]top - 35.165.251.24 ibm-technoligi[.]top - 62.109.29.26 polki |
| domain | polkiuj.top | i[.]top - 35.165.251.24 ibm-technoligi[.]top - 62.109.29.26 polkiuj[.]top - 35.165.251.241 polkiuj[.]top - 46.173.219.161 suzemodel |
| domain | suzemodels.top | lkiuj[.]top - 35.165.251.241 polkiuj[.]top - 46.173.219.161 suzemodels[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofela |
| domain | zofelaseo.top | ls[.]top - 35.163.101.72 astrovoerta[.]top - 185.159.130.89 zofelaseo[.]top - 35.163.101.72 These domain names were registered a day |
| ipv4 | 185.159.130.89 | 6.173 guntergoner[.]top - 35.163.101.72 guntergoner[.]top - 185.159.130.89 ibm-technoligi[.]top - 35.165.251.24 ibm-technoligi[.]top - |
| ipv4 | 35.163.101.72 | 219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163.101.72 guntergoner[.]top - 185.159.130.89 ibm-technoligi[.]top - 3 |
| ipv4 | 35.165.251.24 | 2 guntergoner[.]top - 185.159.130.89 ibm-technoligi[.]top - 35.165.251.24 ibm-technoligi[.]top - 62.109.29.26 polkiuj[.]top - 35.165. |
| ipv4 | 35.165.251.241 | .251.24 ibm-technoligi[.]top - 62.109.29.26 polkiuj[.]top - 35.165.251.241 polkiuj[.]top - 46.173.219.161 suzemodels[.]top - 35.163.10 |
| ipv4 | 35.165.86.173 | IP address. adibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163.101.72 guntergoner[.]top - 185.1 |
| ipv4 | 46.173.219.161 | hows each domain followed by its IP address. adibas[.]top - 46.173.219.161 footarepu[.]top - 35.165.86.173 guntergoner[.]top - 35.163. |
| ipv4 | 62.109.29.26 | ibm-technoligi[.]top - 35.165.251.24 ibm-technoligi[.]top - 62.109.29.26 polkiuj[.]top - 35.165.251.241 polkiuj[.]top - 46.173.219.1 |
From the original article
5 min read at unit42.paloaltonetworks.com
In recent months, we've been tracking a malicious spam (malspam) campaign using emails with no message content and an attached zip archive to spread ransomware. We've nicknamed this campaign "Blank Slate" because the malspam messages are blank with nothing to explain the malicious attachments.
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.