March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Cerberus Banking Trojan – Active IOCs
October 11, 2021
Rewterz Threat Alert – APT-C-41 StrongPity – Active IOCs
October 11, 2021
Rewterz Threat Alert – Cerberus Banking Trojan – Active IOCs
October 11, 2021
Rewterz Threat Alert – APT-C-41 StrongPity – Active IOCs
October 11, 2021
Severity
High
Analysis Summary
Following samples of Lazarus group aka Guardians of Peace, a state-sponsored North Korean threat actor group targeting financial organizations for their gains have been active again and actively targeting different organizations via phishing emails dropping malicious word documents which enables macro when downloaded and executed. The malicious file suspected of being used as an attachment has the name Profit and Loss Statement. zip and Profit and Loss Statement.xlsx.lnk. Previously these campaigns were specifically crafted to target Russian organizations but now they’ve shifted their tilt towards Asia pacific region
Impact
- Exposure of Sensitive Data
- Information Theft and Espionage
Indicators of Compromise
MD5
- f93fd9e83ba89169946af8a70a21139a
SHA-256
- cf10c1cad090ab31d9e579df3bd22f3d0653792cb010e1d6ac0e2cd1ced52076
SHA-1
- 23d10901395b484f57492fb40ec590254aedb1dc
Remediation
- Always be suspicious about emails sent by unknown senders.
- Never click on links/attachments sent by unknown senders.
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.