Malicious Campaign Targets German Organizations

A threat actor, not yet identified, has been targeting German companies with information stealing malware since at least mid-2021.
The German companies targeted have been in the automotive sector or have known ties to the automotive and manufacturing industry.
The infrastructure used in the campaign mimicked target and partner sites and often retrieved payloads from infrastructure hosted in Iran.
Throughout the campaign recipients received emails with a malicious ISO attachment to bypass an NTFS Mark-of-the-Web control.
Once the ISO had been opened by the recipient, a decoy purchase agreement was displayed while a combination of PowerShell and VB scripts retrieved and executed malicious payloads and modified registry settings.
Much of the malware used in the campaigns are Malware-as-a-Service payloads including AZORult, BitRAT and Raccoon info stealers.

Sign Up For Threat Alerts

Loading...
Threats Icon

Jun 30, 2022

YTStealer Malware: YouTube Cookies! Om Nom Nom...

The Dark Web Market for YouTube Account Access In 2006, the term "data is the...

Threats Icon

Jun 27, 2022

Bronze starlight Ransomware Operations Use HUI Loader

The BRONZE RIVERSIDE threat group is likely responsible for stealing intellectual property from Japanese organizations....

Threats Icon

Jun 27, 2022

The Black Basta ransomware is a new...

Although active for just two months, the group already rose to prominence claiming attribution of...

Threats Icon

Jun 27, 2022

Gallium APT Group

Researchers from Palo Alto Networks defined the PingPull RAT as a "difficult-to-detect" backdoor that leverages...

Threats Icon

Jun 26, 2022

US Cert Alert – Malicious Cyber Actors...

The Cybersecurity and Infrastructure Security Agency (CISA) and United States Coast Guard Cyber Command (CGCYBER)...

Threats Icon

Jun 23, 2022

Matanbuchus: Malware-as-a-Service with Demonic Intentions

A new malware-as-a-service (MaaS) called Matanbuchus Loader was discovered in underground markets by Unit42. Malware...

Threats Icon

Jun 22, 2022

Websites Hosting Fake Cracks Spread Updated CopperStealer...

Analysts noticed a new version of CopperStealer and analyzed these samples to be related to...

Threats Icon

Jun 21, 2022

Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect...

Symbiote is a shared object (SO) library that is loaded into all running processes using...

Threats Icon

Jun 19, 2022

HelloXD Ransomware Installing Backdoor on Targeted Systems

Systems are being targeted by a ransomware variant called HelloXD, with the infections also involving...

Threats Icon

Jun 16, 2022

Panchan’s Mining Rig: New Golang Peer-to-Peer Botnet

Akamai security researchers discovered Panchan, a new peer-to-peer botnet and SSH worm that emerged in...

Threats Icon

Jun 15, 2022

PureCrypter: A Fully-Functional Loader Distributing Remote Access...

PureCrypter is a fully-featured loader being widely sold The malware has been observed distributing a...

Threats Icon

Jun 14, 2022

CERT-IL Alert: an active phishing campaign in...

Recently new information was passed to the CERT-IL team indicating that there is an active...

Threats Icon

Jun 13, 2022

Follina suspected state aligned phishing campaign

Proofpoint blocked a suspected state aligned phishing campaign targeting European gov & local US gov...

Threats Icon

Jun 09, 2022

Newly-Discovered Chinese-linked APT Has Been Quietly Spying...

Cado Labs regularly analyses attacks targeting services running within a honeypot infrastructure. One recent attack...

Threats Icon

Jun 08, 2022

Active Exploitation of Confluence CVE-2022-26134

Atlassian published a security advisory for CVE-2022-26134, a critical unauthenticated remote code execution vulnerability in...