Log in Request a demo

Security News

The New Phishing Attack Detected Using Multiple Malware Types

A phishing campaign targeting Microsoft Windows users used three different types of malware designed to snatch sensitive information from targets.

Brandefense logo Updated 2 Min Read
microsoft onenote vulnerability

A phishing campaign aimed at Microsoft Windows users delivered three types of malware at once. It starts with a spear-phishing email that carries a malicious Excel file posing as a payment report. Once the file is opened and its macro runs, the malware is downloaded and steals sensitive information such as passwords and bank details.

What is this phishing campaign?

A phishing campaign targeting Microsoft Windows users used three different types of malware designed to snatch sensitive information from targets.

How does the chain of attacks begin?

The chain of attacks begins with sending spear-phishing emails containing a malicious Excel document to the targets, which appears to be a payment report notification from a trusted source. Emails try to persuade recipients to open the attached Excel document for report detail. When the Excel file called “Remittance-Details-951244.xlam” is opened, and the macro is activated, a VBA (Visual Basic Application) script called “Auto_Open()” is executed, which is responsible for downloading the malware to be used in the campaign.

Which malware does the attack install?

As a result of a series of steps performed through Powershell and the stated VBA scripts, malicious software called AveMariaRAT, BitRAT, and PandoraHVNC, which is responsible for capturing users’ sensitive information, including passwords and bank information, is downloaded to the target system. BitRAT can take full control of infected Windows systems, monitor webcam activity, listen to audio over the microphone, allow threat actors to perform undetected transactions on compromised cryptocurrency wallets, and download additional malicious files, which is why it was considered particularly dangerous.

How can you avoid similar attacks?

There are no details yet as to why the campaign involved three malware. Still, the three different types of malware distributed are known to increase the chances of threat actors accessing sensitive information they want to capture. In this context, to not be the target of similar attacks, it is recommended not to rely on emails, attachments, and links from unknown parties and to prefer comprehensive security solutions.

Frequently Asked Questions.

How does this malware phishing campaign start?

It begins with spear-phishing emails carrying a malicious Excel document that looks like a payment report. When the file is opened and the macro is activated, a VBA script called Auto_Open() runs and downloads the malware.

Which malware does the campaign deliver?

The post names AveMariaRAT, BitRAT and PandoraHVNC. MITRE ATT&CK lists Ave Maria as an alias of WarzoneRAT, a remote access tool for Windows that can steal browser and email passwords.

What is a spear-phishing attachment?

MITRE ATT&CK describes it as an email sent to specific victims with a malicious file. The target usually has to open the file for the payload to run.

How can I avoid similar attacks?

The post recommends not trusting emails, attachments and links from unknown parties and using comprehensive security solutions.

Sources

  1. 1 MITRE ATT&CK: WarzoneRAT (S0670)
  2. 2 MITRE ATT&CK: Spearphishing Attachment (T1566.001)

Try it on your own domain

Type a domain to see the kinds of imitations an attacker would consider.

Generated in your browser, nothing is sent.

    Check a domain with the free scanner

    Share

    In This Article

    TechniquesPhishing (T1566): ATT&CK Technique TermsMalware TermsSpear phishing TermsThreat actor

    Where To Next.

    All Security News Articles
    Related · Technique Phishing (T1566): ATT&CK Technique

    Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

    Open →     Keep reading · Article New Goal of Fraud and Phishing Activities: LinkedIn Users

    LinkedIn, a business network and social sharing platform, is frequently used by threat actors in phishing activities carried out through various methods.

    Open →     Keep reading · Article Bitter APT Targets Bangladesh’s Key Institutions Through Phishing Emails

    Bitter APT used phishing emails with malicious documents to target Bangladesh's key institutions.

    Open →

    Knowledge HubMalware and tools