Evil Corp phishing campaign is using attachments featuring HTML redirectors for delivering malicious Excel documents. The final payload is being dropped using an Excel document that bundles a malicious macro. Evil Corp (also tracked as TA505 and SectorJ04) is a financially motivated cybercrime group known for focusing on attacks against retail companies and financial institutions via large-sized malicious spam campaigns driven by the Necurs botnet.This threat actor distributed remote access Trojans (RATs) and malware downloaders that delivered the Dridex and Trick banking Trojans as secondary payloads, as well as Locky, BitPaymer, Philadelphia, GlobeImposter, Jaff ransomware strains on their targets’ computer.
The new campaign uses HTML redirectors attached to emails. When opened, the HTML leads to the download Dudear, a malicious macro-laden Excel file that drops the payload.
The phishing messages come with HTML attachments which will automatically start downloading the Excel file used to drop the payload.The victims are instructed to open the Excel document on their computer as online previewing is not available and to enable editing to get access to its contents.Once executed on the victim’s computer, the malware will also attempt to drop an info-stealing Trojan tracked by Microsoft as GraceWire. Like most other info stealers, this will also start collecting sensitive information from the victim’s device and send it to its masters via a command-and-control server.