Rewterz Threat Advisory – CVE-2020-11996 – Apache Tomcat denial of service Vulnerability
June 29, 2020Rewterz Threat Alert – Leviathan APT Campaign
June 29, 2020Rewterz Threat Advisory – CVE-2020-11996 – Apache Tomcat denial of service Vulnerability
June 29, 2020Rewterz Threat Alert – Leviathan APT Campaign
June 29, 2020Severity
High
Analysis Summary
LokiBot is trojan-type malware designed to infiltrate systems and collect a wide range of information. Lokibot targets Android and Windows operating systems. It is distributed via spam emails, various private messages (SMS, Skype, etc.), and malicious websites. It is designed to target users. LokiBot gathers saved logins/passwords (mostly in web browsers) and continually tracks users’ activity (for instance, recording keystrokes). Recorded information is immediately saved on a remote server controlled by LokiBot’s developers.
Impact
- Exposure of sensitive information
- Credential theft
Indicators of Compromise
URL
- http[:]//globalresults[.]cf/L3/fre[.]php
- http[:]//auongo[.]com/~zadmin/lk/dn/gate[.]php
- http[:]//office365-account-verify[.]tk/Pablo/fre[.]php
- https[:]//online-hyper[.]ir/wp-includes/hu/fre[.]php
- http[:]//sportsgroup-hk[.]com/six/bryt2/fre[.]php
- http[:]//clemglobal[.]com/bobby2file/five/fre[.]php
- http[:]//sbqlobalfoods[.]com/rich/Panel/fre[.]php
- http[:]//flexpak-th[.]com/osama/aboki/fre[.]php
Remediation
- Block the threat indicators at their respective controls
- Always be suspicious of unsolicited email.
- Never click/ download any attachments sent from unrecognized senders.