• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert: New Phishing Campaign Targeting Bank Employees in Pakistan, Faking Identity of Bank Al-Habib
January 28, 2019
Rewterz Threat Alert: Fresher Phishing Campaigns Targeting Pakistani Bank Employees
January 29, 2019

Rewterz Threat Alert: The Cobalt gang exploiting Google App Engine to distribute malware through PDF decoy documents

January 29, 2019

SEVERITY: HIGH

 

 

CATEGORY: DATA BREACH

 

 

ANALYSIS SUMMARY

 

 

Known for targeting financial organizations, the Cobalt gang resurfaces with another campaign that drops malware. About 42 targets from the financial and banking sector around the World have been attacked by the Cobalt gang’s campaign, meant to drop malware via PDF decoys using App Engine Google Cloud computing platform (GCP).

 

The attackers are abusing the GCP URL redirection in PDF decoys and redirecting to the malicious URL hosting the malicious payload.

 

 

 

 

The URL hosting the malware points the host URL to Google App Engine, making it more trust-able for the targets. Most of the PDF’s involved were created using Adobe Acrobat 18.0. The PDF decoy downloads a word document containing obfuscated macro code. This document was downloaded from the URL https://transef[.]biz.

 

 

 

 

Once the download is complete, a message pops up on opening the document that requires enabling editing and content mode to view the document. On enabling the option, the macro is executed downloading another stage payload.

 

 

IMPACT

 

 

Code Execution

Malware Infection

 

 

INDICATORS OF COMPROMISE

 

URLs

 

 

  • pace[.]edu
  • ulaval[.]ca
  • metacase[.]eu
  • ivywise[.]com
  • transef[.]biz
  • ebf[.]eu[.]com
  • hxxps://appengine.google[.]com/_ah/logout?continue=https%3A%2F%2Ftransef[.]biz%2FDoc102018[.]doc
  • https://appengine.google[.]com/_ah/logout?continue=https%3A%2F%2Fswptransaction-scan2034[.]s3[.]ca-central-1[.]a mazonaws[.]com%2FDoc102018[.]doc

 

 

FILENAME

 

 

  • fr[.]txt

 

 

EXTENSION

 

 

.eml

 

 

EMAIL ADDRESS

 

 

  • jk01814n[@]pace[.]edu
  • benoit[.]filion[.]2[@]ulaval[.]ca
  • alexandre[.]custeau[.]1[@]ulaval[.]ca
  • dominique[.]denis-berube[.]1[@]ulaval[.]ca
  • helpdesk[@]metacase[.]eu
  • adrienne[@]ivywise[.]com
  • info[@]ebf[.]eu[.]com
  • sec[@]ebf[.]eu[.]com
  • r[.]evans[@]ebf[.]eu[.]com

 

 

REMEDIATION

 

 

  • Block the threat indicators at their respective controls.
  • Warn users against opening un-trusted attachments, regardless of their extensions or filenames.
  • Warn users to avoid executing any file without confirming that they are not malicious.
  • Un-check the option “Remember this action for this site for all PDF documents” in the PDF reader software. The Default Allow policy can help in downloading malware even from trusted sites like Google App Engine.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.