Tag: T1053

Engage Report: Double-Tap Campaign – Espionage in Central Asia

  1. A malicious macro in the initial Word document creates a second blank document and weaponizes it with another malicious macro.
  2. The second macro creates a scheduled task named “SettingsService Dispatch” using RegisterTaskDefinition.
  3. This task executes an HTA file containing the HATVIBE backdoor every four minutes using mshta.exe.
Read more...

Pygmy goat Backdoor

Pygmy Goat uses the LD_PRELOAD environment variable to inject itself into the sshd process, ensuring it’s loaded and executed whenever the SSH daemon starts.

Read more...

COLDRIVER – UNC4057, Star Blizzard and Callisto

The attacker, impersonating experts or affiliates, sends a phishing link or document containing a link to a “decryption” utility. This utility is malware (SPICA backdoor) that gives the attacker access to the victim’s machine. The malware establishes persistence, communicates with a C2 server using JSON over WebSockets, and then collects and exfiltrates data.

 

Read more...