The Ukrainian Computer Emergency Response Team (CERT-UA) has issued a warning about a new wave of social engineering attacks that deploy IcedID malware and steal sensitive data using Zimbra flaws.
According to the CIA, the IcedID phishing assaults are tied to a threat cluster known as UAC-0041. The infection chain starts with an email that contains a Microsoft Excel document (олани pестp.xls or Mobilization Register.xls) that invites users to enable macros, culminating in IcedID deployment.
BokBot, also known as TrickBot, Emotet, and ZLoader, is a data-stealing malware that has developed from its beginnings as a banking trojan to a full-fledged crimeware service that aids in the recovery of next-stage infections like ransomware.
Email attachments with a Content-Location header leading to a remote server holding JavaScript code that performs an exploit for a Zimbra cross-site scripting vulnerability are part of the second wave of targeted assaults linked to the UAC-0097 threat group (CVE-2018-6882).
In the last phase of the attack chain, the injected malicious JavaScript is used to send victims’ emails to an email address controlled by the threat actor, indicating a cyber espionage effort.
The attacks are part of a pattern of hostile cyber activities directed towards Ukraine that began in January. CERT-UA recently announced that it has foiled a Russian hack aiming at undermining the operations of an undisclosed Ukrainian energy company.
LadiTech Cyber security services
We provide on-demand knowledge as well as the ongoing threat monitoring and response necessary to prevent assaults from causing damage to your business. You’ll receive the help you need when you need it most if you maximize efficiency while decreasing costs. A single unified dashboard may be used to monitor and analyze data and trends, and logs can be retrieved at any time. We help businesses respond to attacks faster and more effectively by using cutting-edge cybersecurity technologies while preserving a well-documented audit trail.
For more information contact us:
- +16134167874
- +90 (212) 900 9094
- contact@laditech.com
