Microsoft advanced machine learning threat detection models detected multiple malspam campaigns distributing malware-laced ISO.
Last week experts from Microsoft detected a COVID-19-themed spam campaign, the messages are crafted to trick users into downloading and mounting ISO or IMG file attachments. The bait ISO or IMG files were infected with a strain of the Remcos remote access trojan (RAT).
The campaign was targeting specific sectors using COVID-19 themed lures, the Remcos campaigns appear to be limited and short-lived to avoid the detection.
“We also saw a campaign targeting manufacturing companies in South Korea. Attackers sent target organizations an email that impersonates CDC’s Health Alert Network (HAN) and carrying malicious ISO file attachments. The ISO file contains a malicious SCR file, which is Remcos.” states Microsoft in a tweet.
Major malspam campaigns monitored by Microsoft include attacks at US small businesses, manufacturing companies in South Korea, and accountants in the US.
In the campaign against US small businesses, the messages pretended to be from the US Small Business Administration (SBA), carrying a malicious IMG (disk image) attachment. The IMG file contained an executable file that uses a misleading PDF icon, which once executes start the Remcos RAT infection.
In the campaign that targeted manufacturing companies in South Korea, threat actors impersonate CDC’s Health Alert Network (HAN). The attacks employed ISO file attachments containing a malicious SCR file used to install the Remcos RAT.
The third campaign observed by Microsoft targeted accountants in the US, in this case with COVID as lures. The messages pretend to provide “COVID-19 related updates” for members of the American Institute of CPAs. In this case, attackers used a ZIP archive containing a ISO file carrying a malicious SCR file with a misleading icon.
At the time it is still unclear the end goal of the malspam campaigns, the combination of a specific type of attachment and the exploitation of COVID-19 as a lure characterized this malspam.
Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
(SecurityAffairs – COVID-19, malspam)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.