Security News > 2022 > September > Fake US govt job offers push Cobalt Strike in phishing attacks
A new phishing campaign targets US and New Zealand job seekers with malicious documents installing Cobalt Strike beacons for remote access to victims' devices.
The discovery comes from researchers at Cisco Talos who observed two different phishing lures, both targeting job seekers and leading to the deployment of Cobalt Strike.
Both attacks begin with a malicious email that presents the recipient with a lucrative job offer in the US federal government, supposedly sent from the US Office of Personnel Management.
The executable launches a PowerShell command that downloads the Cobalt Strike DLL to the %UserProfile%AppDataLocalTemp directory and then deletes itself.
With Cobalt Strike being one of the most widely used tools to gain initial access to corporate networks and spread laterally within one, we have seen an increase in phishing attacks distributing beacons over the past few years.
Last year, Emotet phishing attacks started dropping Cobalt Strike for the first time, and more recently, phishing attacks have targeted Russian dissidents and Ukrainian entities.
News URL
Related news
- US cities warn of wave of unpaid parking phishing texts (source)
- Ukrainian military targeted in new Signal spear-phishing attacks (source)
- Phishing platform 'Lucid' behind wave of iOS, Android SMS attacks (source)
- iOS devices face twice the phishing attacks of Android (source)
- China names alleged US snoops over Asian Winter Games attacks (source)
- Windows NTLM hash leak flaw exploited in phishing attacks on governments (source)
- Three Reasons Why the Browser is Best for Stopping Phishing Attacks (source)
- Phishing detection is broken: Why most attacks feel like a zero day (source)
- DPRK Hackers Steal $137M from TRON Users in Single-Day Phishing Attack (source)
- Low-tech phishing attacks are gaining ground (source)