Security News > 2021 > October > 'Lone Wolf' Hacker Group Targeting Afghanistan and India with Commodity RATs

A new malware campaign targeting Afghanistan and India is exploiting a now-patched, 20-year-old flaw affecting Microsoft Office to deploy an array of commodity remote access trojans that allow the adversary to gain complete control over the compromised endpoints.

The attacks work by taking advantage of political and government-themed lure domains that host the malware payloads, with the infection chains leveraging weaponized RTF documents and PowerShell scripts that distribute malware to victims.

Specifically, the laced RTF files were found exploiting CVE-2017-11882 to execute a PowerShell command that's responsible for deploying additional malware to conduct reconnaissance on the machine.

The recon phase is followed by a similar attack chain that uses the aforementioned vulnerability to run a series of instructions that culminates in the installation of commodity malware such as DcRAT, and QuasarRAT that come with a variety of functionalities right out of the box including remote shells, process management, file management, keylogging, and credential theft, thus requiring minimal efforts on part of the attacker.

"This campaign is a classic example of an individual threat actor employing political, humanitarian and diplomatic themes in a campaign to deliver commodity malware to victims," the researchers said.

These families also act as excellent launch pads for deploying additional malware against their victims.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/a6Rp-gw4_o8/lone-wolf-hacker-group-targeting.html