Rewterz Threat Alert – PatchWork APT Groups Targeting Pakistani Government Officials – Active Campaign
December 10, 2021Rewterz Threat Advisory – CVE 2021- 44228 RCE 0-day Exploit in log4j
December 10, 2021Rewterz Threat Alert – PatchWork APT Groups Targeting Pakistani Government Officials – Active Campaign
December 10, 2021Rewterz Threat Advisory – CVE 2021- 44228 RCE 0-day Exploit in log4j
December 10, 2021Severity
High
Analysis Summary
An emergent and effective data-harvesting tool dubbed Oski is proliferating in North America and China, stealing online account credentials, credit card numbers, crypto wallet accounts, and more. The malware is still in its developing phase but packs a punch with its capabilities. Oski C2’s dashboard revealed that Oski’s theft tactics involve extracting credentials using man-in-the-browser (MitB) attacks by hooking the browser processes using DLL injection, It also extracts credentials from the registry, passwords from the browser SQLite database, and stored session cookies of all stripes, including crypto-wallet cookies from Bitcoin Core, Ethereum, Monero, Litecoin, and others.
Impact
- Credential Theft
- Unauthorized Access
Indicators of Compromise
MD5
- 5c40517b3b632caf07cb45afa5aa1140
- dbab23f56fe907a1331afffa304ebeb9
SHA-256
- 2e6bebcaaa746b7ab28bf74c49dc0b92b88f564f5b05d6cc414ea1d4aa5f10d4
- 5e90017c211f7f6fb00a452e7cc887b8da779dc03314c004ef609d37a7dcc8ce
SHA-1
- 767c28385881fdc01b43b730aa50168f23d934f9
- cf077d805094232be37824dcda065e2b46b3a5a8
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.
- Search for IOCs in your environment.