Stage 6: The njRAT that runs under Caspol.exe will be unleashed and it will connect to a remote C2 server. Stage 5: The invoked DLL will download and inject the njRAT binary to Caspol.exe (a legitimate Microsoft. Stage 4: The DLL will download and invoke an additional DLL. Stage 3: Inside of the archive the user will find a VBS script that, once executed, downloads two files: one from discord CDN (which is the njRAT binary) and a DLL from a remote site. Stage 2: After opening the PDF, the user is prompted to click on another URL, a password protected archive downloaded automatically from Discord CDN. Stage 1: Once the user clicks on the URL, a PDF file automatically downloads from Discord CDN. The below image shows the steps involved in the attack: The components of the attack span multiple stages. Then we ask you to consult the following web page where you will find the details of the embargo process. Translation: Bogota SeptemLet us notify you of the TAX SEIZURE ORDER established against you for failure to comply with your tax obligations.
Furthermore, “TAX SEIZURE ORDER” is written in caps lock in order to apply pressure on the user as part of social engineering technique. There are some warning signs within the email itself, like how the domain of the sender is not associated in any way with the URL presented in the mail. The user is meant to click on this link to learn more about the “tax seizure.” At the end of the message there is a URL with an embedded link. The user receives an urgent email alerting them of a tax seizure in their name. Like most attacks these days, this campaign starts with a payload delivered via email, the number one attack vector for cyber attacks.
This means that it is usually used by threat actors looking to control infected PCs remotely or spy on the users by capturing keystrokes, watching users on their webcam, or even listening to a user’s microphone. NjRAT is a malware classified as a Remote Access Trojan. *A CDN, or content delivery network, is a set of geographically disparate servers used to speed up processing of heavy attachments or webpages. In this blog post, we review a recent phishing campaign that leverages Discord CDN* to host malicious files and lure unsuspecting users into becoming victims of the njRAT malware.
0 kommentar(er)
