Operation ShadowCat: Targeting Indian Political Observers via a Stealthy RAT
Excerpt
Cyble Research and Intelligence Labs (CRIL) came across an intriguing shortcut (.LNK) file masquerading as a legitimate Office document.
When the user executes the LNK file, it triggers the infection process, which runs a PowerShell command to drop and execute a .NET loader, ultimately delivering the final payload to the victim’s machine.
The Threat Actor (TA) employs steganography to conceal a malicious Gzip-compressed payload within a PNG file, which is hosted on a Content Delivery Network (CDN).
The decompressed payload is then injected into PowerShell.exe using the Asynchronous Pr…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by app.box.com on app.box.com.
More from app.box.com4
- Inexsmar: An unusual DarkHotel campaigapp.box.com · Added 2 May
- UAC-0056 cyberattack on Ukrainian authorities using GraphSteel and GrimPlant malwareapp.box.com · Added 1 May
- North Korea-linked APT attack found disguised as a digital asset wallet service customer centerapp.box.com · Added 1 May
- Operation Triangulation: The last (hardware) mysteryapp.box.com · Added 17 Dec 2024
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
