Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
Zebrocy APT operators recently launched campaign using a backdoor to maintain access to victim hosts and extract profiling information. The operators used a Golang-based version instead of the variant written in Delphi. Zebrocy is a toolkit of downloaders, droppers, and backdoors, that is associated with the Russian-speaking advanced threat group Sednit. The hackers are also known by the names APT28, Fancy Bear, Sofacy, Group 74, and STRONTIUM. The group targets governments, embassies and Ministries of Foreign Affairs in Eastern European and Central Asian countries. The document attached to the spear-phishing message is blank but includes a reference to a remote payload. Dropbox is used to host the malicious template – wordData.dotm – containing malicious macros that are executed upon opening the empty document.
Depending on the Microsoft Word version, the VBA macros are disabled by default and user action is required to enable them. It also contains an embedded ZIP archive that the macros dropped and extracted.
Theft of Sensitive Information
IP(s) / Hostname(s)
185[.]221[.]202[.]35
URLs
Filename
Malware Hash (MD5/SHA1/SH256)