An increase is seen in targeted attacks against multiple supply chain-related organizations in the oil and gas sector in the Middle East. These targeted attacks use malicious PDF files sent as email attachments used to distribute an information-stealing Trojan, AZORult, in target organizations. The attack chain begins with an email that appears to be from an official working at the ADNOC and is targeted at officials working in the supply chain and government sectors in the Middle East. Each email in this campaign has an attached PDF file. This PDF contains download links on the first page that lead to legitimate file sharing sites, such as wetransfer and mega.nz where a ZIP archive is hosted. The ZIP archive contains a malicious and packed .NET executable that will decrypt, load, and execute the embedded AZORult binary.
The PDF files attached to the email are multipage documents (containing 14 pages) that appear to be Requests for Quotations (RFQ) for supply contracts and legal tenders for various projects based in the Middle East. The decoy documents are carefully crafted to appear legitimate for social engineering purposes. AZORult upon execution will perform information stealing activities on the machine and exfiltrate the information by sending an HTTP POST request to the URL: hxxp[:]//crevisoft.net/images/backgrounds/ob/index.php.