Security Affairs

JUNE 15, 2023

The attack chain commences with spear-phishing emails with malicious attachments (.docx,rar,sfx docx,rar,sfx (self-extracting archives),lnk,hta (HTML smuggling files)) using armed conflicts, criminal proceedings, combating crime, and protection of children, as a lure.

Military 82

Military File names Archiving Phishing 82

Security Affairs

MARCH 15, 2020

Researchers from MalwareHunterTeam discovered a suspicious RAR file named “COVID-19-” that was being distributed online, likely through phishing emails. "Important The RAR archive contains a file named “Important – COVID-19” that displays a Word icon.

Communications 110

Communications File names Archiving Phishing 110

Security Affairs

MAY 10, 2023

.” The threat actors sent spear-phishing messages with diplomat-themed lure documents. The attackers used executable files posing as Microsoft Word document. The experts noticed that the attachment was simply named “ ! exe ” and used the icon image associated with docx files. to embassy kazakh 2022.exe

File names 89

File names Archiving Phishing Government 89

Security Affairs

SEPTEMBER 3, 2020

Attackers carried out spear-phishing emails using the Know Your Customer regulations (KYC) as a lure. The new infection chain starts by including just one LNK file in the ZIP archive attached to spear-phishing messages. The PyVil RAT was recently employed in attacks against FinTech companies across the U.K.

Phishing 135

Phishing Encryption File names Metadata 135

Security Affairs

MAY 29, 2019

Hash 0c88e285b6fc183c96b6f03ca5700cc9ca7c83dfccc6ad14a946d1868d1cc273 Threat Dropper Brief Description Excel file with malicious macro Ssdeep 3072:Mc38TehYTdeHVhjqabWHLtyeGxml8/dgzxXYhh3vVYwrq 8/P5HKuPF1+bkm13Kkf:B38TehYTdeHVhjqabWHLty/xml8/dgNr. The intercepted attack starts with a spear-phishing email embedding a spreadsheet.

IT 66

IT Retail Archiving File names 66

Security Affairs

AUGUST 5, 2019

Recently a data-wiping malware tracked as GermanWiper has been targeting German organizations, the malicious code is pushed via phishing messages. GermanWiper is being distributed in Germany through spam messages that pretend to be emails sent by a job applicant named Lena Kretschmer that is submitting her resume.

Ransomware 68

Ransomware Encryption File names Archiving 68

Security Affairs

JULY 8, 2019

Experts observed an increase of the malware spreading using less-known archive types as dropper,in particular ISO image.Delphi wrapper makes analysis harder. In the last period, we observed an increase of the malware spreading using less-known archive types as an initial dropper, in particular, ISO image. Phishing email content.

File names 68

File names Encryption Archiving Phishing 68

Security Affairs

MARCH 2, 2019

In February 2019, SI-LAB captured multiple samples of phishing campaigns using an Office Excel document carrying a malicious Excel 4.0 File name: patent-2019-02-20T093A283A05-1.xls Figure 1: Malicious xls file with an embedded XLM macro not detected by Virus Total. File name : 68131_46_20190219.doc

File names 85

File names Phishing Libraries IT 85

Security Affairs

NOVEMBER 7, 2019

Experts observed a new phishing campaign that used a specially crafted ZIP archive that was designed to bypass secure email gateways to distribute malware. Attackers have devised a new technique to distribute malware bypassing secure email gateways and other security solutions by using a specially crafted ZIP file.

Archiving 91

Archiving Security File names Phishing 91

Security Affairs

JULY 17, 2020

Experts that want to to study phishing attack schema and Kit-composition can use the recently PhishingKitTracker, which is updated automatically. If you are a security researcher or even a passionate about how attackers implement phishing you will find yourself to look for phishing kits. Disclaimer.

Phishing 108

Phishing File names Archiving IT 108

Security Affairs

DECEMBER 15, 2021

A suspected ScreenConnect setup MSI appeared to have been delivered in a zipped file named “Special discount program.zip”, suggesting that it arrived in a spear-phishing email.” The malicious archive was likely spread through spear-phishing messages.

File names 92

File names Passwords Phishing Archiving 92