Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
A Netwire campaign targeting Italian industry. As the Netwire variant was common to known samples, the main focus of their reporting on the subject was the unique attack chain used to distribute the RAT. The campaign begins with an Italian language email and XLS attachment. This XLS attachment contains a macro that kicks off the infection chain if a user opts to enable macros. This macro simply downloads what appears to be an image file but instead is an XSL stylesheet containing JavaScript. The contained JavaScript downloads and executes a VBS file hosted on the same server as the fake image file. In turn, the VBS code fetches yet another payload from the remote server. This payload is downloaded as a .jpg and read by the VBS code as raw bytes that will eventually become executable PowerShell code. The PowerShell code provides two functions. First, it loads a DLL that can perform an AMSI bypass. Then, it loads a second DLL that can inject the Netwire payload into another process. Persistence is established via a Registry Run key. As mentioned, the final payload is the Netwire RAT, which provides attackers with the ability to steal information from victim machines, such as credentials, browser history, and keystrokes. The researchers note that similarities exist between the naming conventions of variables in the payloads from this campaign with those in Aggah campaigns targeting the Italian manufacturing industry.