Briefing Malware - 09/11/2021

New Threat Actor Spoofs Philippine Government, COVID-19 Health Data in Widespread RAT Campaigns

#Proofpoint released a report about a new cyber threat actor, #TA2722. Impersonating multiple Philippine Government entities, TA2722, aka #Balikbayan Foxes, delivers Remote Access Trojan (#RAT) such as #Remcos or #Nanocore through several phishing campaign targeting a lot of different industries in Europe, North America or Southeast Asia. Remcos and Nanocore are #information stealers using multiple mechanism to gather #credentials or command compromised computers. During this campaign, they used OneDrive url linked to #RAR files, #PDF email attachment with #OneDrive link leading to malicious executable or infected #Excel File. During the investigation, Proofpoint identified two threat clusters, #Shahzad73 and #CPRS, which shared some targets, IP addresses and a common email used for domain registration.

https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-spoofs-philippine-government-covid-19-health-data-widespread