Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
High
Analysis Summary
A campaign recently identified and attribute to the Buhtrap Group. These threat actors have been linked to campaigns against Russian financial institutions but recently have expanded their operations to conduct espionage campaigns in Central Asian and Eastern European countries. They were observed utilizing several zero day vulnerabilities (CVE-2019-1132 and CVE-2015-2387) to attack their victims, most recently a government institution. Since being discovered in 2015, the group has added numerous tool sets to their arsenal, but their tactics, such as the use of decoy documents, remain relatively the same. This was the first known instance where the group exploited zero day vulnerabilities to attack their victims. The infection process begins when a user opens a Microsoft Word document, enables macros, and then ultimately downloads the malicious payload.
Impact
Privilege escalation
Indicators of Compromise
URLs
Malware Hash (MD5/SHA1/SH256)
Remediation