Manufacturing and government organizations in Europe and the Middle East have been targeted by a novel malware attack campaign that harnessed obfuscation and User Account Control bypass to facilitate the deployment of a sophisticated commodity loader leveraged by other threat operations to deliver information-stealing payloads and remote access trojans, according to The Cyber Express.Multiple infection vectors, including illicit SVG files, UAC bypass, Office files abusing CVE-2017-11882, and ZIP archives with LNK shortcuts, have been tapped by attackers using phishing emails that spoofed purchase order communications to download a VBS loader, which was previously noted by other security researchers to have allowed the injection of the Katz Stealer and PureLog Stealer, as well as the Remcos RAT, AsyncRAT, and DCRAT strains, a report from Cyble Research and Intelligence Labs showed."The fact that multiple malware families leverage these class naming conventions as well as execution patterns... is further testament to how potent this threat is to the target nations and sectors," said Cyble researchers.
