LuckyMouse hits national data center to organize country-level waterholing campaign

Discussion in '0-day Release' started by RGiskardR, Jun 13, 2018.

  1. RGiskardR

    RGiskardR Malware Tester Silver Member

    [​IMG]
    What happened?

    In March 2018 we detected an ongoing campaign targeting a national data center in the Central Asia that we believe has been active since autumn 2017. The choice of target made this campaign especially significant – it meant the attackers gained access to a wide range of government resources at one fell swoop. We believe this access was abused, for example, by inserting malicious scripts in the country’s official websites in order to conduct watering hole attacks.

    The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool (RAT). The timestamps for these modules are from December 2017 until January 2018. The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression.

    Kaspersky Lab products detect the different artifacts used in this campaign with the following verdicts: Trojan.Win32.Generic, Trojan-Downloader.Win32.Upatre and Backdoor.Win32.HyperBro. A full technical report, IoCs and YARA rules are available from our intelligence reporting service (contact us [email protected]).

    Full reading: https://securelist.com/luckymouse-hits-national-data-center/86083/
     
    silversurfer likes this.
  2. Google Adsense

Share This Page