Managing access: Interview with Glenn Hazard, CEO of Xceedium

Attacks part of the campaign involved the delivery of phishing emails purporting to be freight invoices from DHL Express, which included a ZIP archive with a JavaScript file that facilitated the execution of a PowerShell script communicating with the attacker-controlled command-and-control server, according to an analysis from Infoblox.

Investigation into the incident is still underway but Nominet, which is among the major country code registries, was reported by ISPreview to not have determined any proof of backdoor injections.

After commencing suspicious jsconsole logins on targeted FortiGate firewalls' web-based command-line interface on Nov. 16, threat actors waited until early December to conduct extensive firewall configuration modifications aimed at facilitating SSL VPN access.