Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
Medium
Analysis Summary
Advanced techniques, tools and procedures (TTPs) have been observed being used by a new threat actor in order to bypass cyber controls used by many corporations. This threat actor is targeting financial organizations like banks with more sophisticated tools, complex obfuscation and customization. The attack begins with a phishing email containing a malicious link that downloads a word document. Examples of URLs created by the threat actor include hxxps://socgen-cert[.]com/documents/REQ-193.doc and hxxps://ing[]cert[.]com/documents/PO-2815.doc. The documents were also seen on amf-fr[.]org, alerts-swift[.]com, and socgencompliance[.]com.
Initial Access: Spear Phishing Link
Execution: Scripting, PowerShell, User Execution, Regsvr32
Persistence: Registry Run Keys / Startup Folder (in older versions)
Defense Evasion: Masquerading, Regsvr32, Download New Code at Runtime
Command and Control: Remote Access Tools, Uncommonly Used Port
Impact
Security Bypass
Complex Cyber-attack
Indicators of Compromise
IP(s) / Hostname(s)
URLs
Malware Hash (MD5/SHA1/SH256)
Remediation