Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
A PowerShell script (mailer script) has been seen propagating the distribution of Lemon Duck through weaponized COVID-19 themed emails by researchers. Like the long ago “I Love You” virus, these emails are delivered to all Microsoft Outlook contacts of the user of the compromised machine. The emails sent all contain malicious attachments and, should the receiver open and execute the attachments, Lemon Duck cyrptominer is installed. Currently, this script has been observed in China, Bangladesh, Hong Kong, Egypt, and Indonesia. Targeted industries include clothing, conglomerates, real estate, health, electronics, and shipping/logistics companies/finance. The malicious emails come from familiar sources, which could lead recipients to trust and open the emails, thus leading to infection. The emails contain differing subjects and contents as well as document names and types to include .ZIP and .DOC files. Analysis of the code reveals it creates a pipe and waits for input commands. Furthermore, it checks for administrator rights as well as compiling C# source code to load into memory. The only way to terminate the loaded code from memory is to restart PowerShell. The payload generates a JavaScript file and uses that file to send the infected emails to contacts. In a move to further obfuscate the nefarious activity, the script then deletes the sent emails to hide the evidence.
Cryptocurrency Miner
Block all threat indicators at your respective controls.
Always be suspicious about emails sent by unknown senders.
Never click on the links/attachments sent by unknown senders.