Rewterz Threat Alert – DJVU Ransomware – Active IOCs
March 3, 2022Rewterz Threat Alert – IcedID banking Trojan – Active IOCs
March 3, 2022Severity
High
Analysis Summary
Our security analysts have discovered a new phishing campaign targeting banks in Pakistan. These phishing emails are invoice themed and contain malicious links/files. The email uses the subject Re: 1LINK – Withholding Under KP Sales Tax on Services Special Procedure (Withholding) Regulation, 2015 (Now 2020), to create an urgency to trigger user response, as users will presume this to be a legitimate email and would immediately take action. The sender’s email address is from multiple domains:
info[@]fixeed[.]jp
info[@]takiilaw[.]com
anthem[@]juno[.]ocn[.]ne[.]jp
k_ishii[@]nissokouzai[.]com
info[@]pakinlinks[.]com
kikukawa-inc[.]com
Please note that these domains may not be flagged as malicious yet or haven’t been detected on VirusTotal. However, users are advised to take necessary preventive actions as per the legitimacy of the threat and source.
Impact
- Credential Theft
- Business Email Compromise
Indicators of Compromise
Email Subject
- Re[:] 1LINK – Withholding Under KP Sales Tax on Services Special Procedure (Withholding) Regulation
- 2015 (Now 2020)
Filename
- image004[[.]]jpg
- form[[.]]xlsm
Remediation
- Block the threat indicators at their respective controls.
- If a security alert email looks very legitimate, do not respond to it without confirming legitimacy from network administrators.
- Search for IoCs in your environment.