Malspam campaign spoofs email chains to install IcedID info-stealer

In a new phishing marketing campaign, the offending emails get there in inboxes with attached, password-protected zip archives containing Word files. (Photograph by Justin Sullivan/Getty Visuals)

A phishing marketing campaign has been making an attempt to disguise spam as an email chain, employing real messages taken from email clientele on formerly compromised hosts.

Cybercriminal group TA551, aka Shathak, is behind the procedure, which is acknowledged to unfold info-stealing malware these kinds of as Ursnif, Valak and IcedID, in accordance to a weblog article nowadays from the Device 42 threat research group at Palo Alto Networks.

The campaign usually targets English-speaking victims and dates back as far as Feb. 4, 2019. However, more not too long ago it has expanded its targets to contain German, Italian and Japanese speakers. In the earlier, the attackers often would use Ursnif and Valak as downloaders to secondarily distribute IcedID, but considering that July 2020 it appears they have focused completely on IcedID, delivering it in its place by using malicious macros.

The offending e-mails get there in inboxes with attached, password-protected zip archives containing Word files. If the receiver opens the doc and permits the destructive macros inside, the an infection chain commences and the IcedID malware is mounted.

“TA551 malspam spoofs reputable email chains primarily based on data retrieved from previously infected Windows hosts. It sends copies of these email chains to recipients of the unique email chain,” Menace Intelligence Analyst Brad Duncan wrote in the web site. “The spoofed email involves a shorter information as the most current product in the chain. This is a generic statement asking the recipient to open an connected ZIP archive employing the supplied password. File names for the ZIP archives use the title of the firm being spoofed in the email.”

Unit 42 has pointed out that considering the fact that Oct. 20, 2020, TA551’s traffic styles have “changed substantially,” and artifacts generated throughout bacterial infections also have slightly altered. “These adjustments may possibly be an exertion by malware developers to evade detection. At the pretty the very least, they may confuse another person conducting forensic evaluation on an infected host,” reported Duncan.

Device 42 anticipates the TA551 campaign will evolve even more in the coming months.

Some elements of this article are sourced from:
www.scmagazine.com