Advanced techniques, tools and procedures (TTPs) have been observed being used by a new threat actor in order to bypass cyber controls used by many corporations. This threat actor is targeting ﬁnancial organizations like banks with more sophisticated tools, complex obfuscation and customization. The attack begins with a phishing email containing a malicious link that downloads a word document. Examples of URLs created by the threat actor include hxxps://socgen-cert[.]com/documents/REQ-193.doc and hxxps://ingcert[.]com/documents/PO-2815.doc. The documents were also seen on amf-fr[.]org, alerts-swift[.]com, and socgencompliance[.]com.
Initial Access: Spear Phishing Link
Execution: Scripting, PowerShell, User Execution, Regsvr32
Persistence: Registry Run Keys / Startup Folder (in older versions)
Defense Evasion: Masquerading, Regsvr32, Download New Code at Runtime
Command and Control: Remote Access Tools, Uncommonly Used Port
Indicators of Compromise
IP(s) / Hostname(s)
Malware Hash (MD5/SHA1/SH256)
Block the threat indicators at their respective controls.
Ensure strict measures against phishing emails.