SEVERITY: HIGH
CATEGORY: DATA BREACH
ANALYSIS SUMMARY
Known for targeting financial organizations, the Cobalt gang resurfaces with another campaign that drops malware. About 42 targets from the financial and banking sector around the World have been attacked by the Cobalt gang’s campaign, meant to drop malware via PDF decoys using App Engine Google Cloud computing platform (GCP).
The attackers are abusing the GCP URL redirection in PDF decoys and redirecting to the malicious URL hosting the malicious payload.
The URL hosting the malware points the host URL to Google App Engine, making it more trust-able for the targets. Most of the PDF’s involved were created using Adobe Acrobat 18.0. The PDF decoy downloads a word document containing obfuscated macro code. This document was downloaded from the URL https://transef[.]biz.
Once the download is complete, a message pops up on opening the document that requires enabling editing and content mode to view the document. On enabling the option, the macro is executed downloading another stage payload.
IMPACT
Code Execution
Malware Infection
INDICATORS OF COMPROMISE
URLs
FILENAME
EXTENSION
.eml
EMAIL ADDRESS
REMEDIATION