In recent reports, eSentire TRU has reported the resurgence of a malicious campaign that targets manufacturing, commercial, and healthcare organizations. This resurgence of the campaign may indicate a new wave of cyberattacks on these sectors, and highlights the need for increased cybersecurity measures to prevent this type of attack.
Threat actors involved: native Russian speakers
According to eSentire TRU, the campaign is being carried out by threat actors who are native Russian speakers. While the identity of the group behind the campaign is not yet known, eSentire TRU believes that it may be related to cyber espionage or data theft.
Attack Methodology: PDF Attachments via Email Hijacking
The attackers use a simple but effective method to infiltrate target organizations. They attack via PDF attachments that are delivered through email hijacking. In order to increase the chances of successfully attacking the target, the PDFs have been crafted to look legitimate and are often tailored to the recipient organization.
Domain Spoofing: Including Sender Domain in Vesta Control Panel
The attackers also use domain spoofing to increase their chances of success. By including the sender domain within the Vesta Control Panel, the domain is made to look genuine, even though it is actually a spoofed domain. This ensures that the email appears to be coming from a legitimate source, making it more likely that the recipient will open the attachment.
Domain redirection: Redirecting users to the saprefx[.]com domain through a link
Once the user opens the PDF attachment, they are typically redirected to the saprefx[.]com domain via a link. This domain serves as a staging ground for the next stage of the attack.
Hosting Platform: Compromised WordPress Websites for JavaScript Payloads
The compromised WordPress websites serve as the hosting platform for the JavaScript payload that is used in the attack. This is a relatively new tactic and highlights the vulnerabilities that can be exploited within seemingly legitimate websites.
Inclusion of Tools: Several Tools and Scripts in MSI Files Used by Attackers
Several tools and scripts are included in the MSI files used by the attackers. These tools are mainly tailored to capture screenshots of the infected computer, which can provide the attackers with valuable information about the target organization.
Tool Functionality: Mainly tailored to capture screenshots of infected computers
The tools used in the attack are highly sophisticated and mainly tailored to capture screenshots of the infected computer. This allows the attackers to gain access to a wide range of sensitive information, including login credentials and other forms of data that could be used in future attacks.
Execution Process of Implementation of AutoHotKey Script
The process is executed through the implementation of an AutoHotkey script. This script is used to automate keystrokes and mouse clicks on the infected computer, which allows the attackers to gather data without the need for manual interaction.
Campaign goal: believed to be related to cyber espionage
The goal of this campaign is not yet clear, but it is believed to be related to cyber espionage. By targeting manufacturing, commercial, and healthcare organizations, the attackers could gain access to valuable intellectual property, trade secrets, and other sensitive information.
The resurgence of this malicious campaign highlights the need for increased cybersecurity measures within organizations. By understanding the tactics used by attackers, organizations can take steps to prevent these types of attacks. This could include implementing email security protocols, using antivirus and anti-malware solutions, and increasing staff awareness of the potential dangers of phishing emails. By taking a proactive approach to cybersecurity, organizations can better protect themselves from these types of attacks and prevent potentially devastating data breaches.