Global Scale Phishing Attack Brings New Malware

There’s an ongoing, global scale phishing attack you should be aware of, even if your firm isn’t currently being targeted by it.

The attack is being tracked by Mandiant, who recently published a report about it. According to that report, the attack was planned in waves, hitting more than 50 different organizations spanning a broad range of industries.

These attacks happened on December 2^nd, December 11^th, and again on December 18^th, 2020.

There are two things that make this attack particularly worrisome. First, Mandiant was unable to identify a specific threat actor behind them. Due to that, they’re simply tracking the group as “UNC2529,” with the UNC identifier tagging the group as currently unknown and uncategorized.

Second is the fact that there’s obviously a high level of talent behind the attacks, as it uses highly targeted spear phishing techniques to deploy three different strains of malware never seen before. Even worse is the fact that the group has taken great pains to ensure that their malicious code lands on target systems undetected.

A spokesman for Mandiant had this to say about the attacks:

The threat actor made extensive use of obfuscation and fileless malware to complicate detection to deliver a well coded and extensible backdoor.

“One interesting fact about the whole ecosystem is that only the downloader exists in the file system. The rest of the components are serialized in the registry database, which makes their detection somewhat harder, especially by file-based antivirus engines.

Masquerading as the account executive, seven phishing emails were observed targeting the medical industry, high-tech electronics, automotive and military equipment manufacturers, and a cleared defense contractor with subject lines very specific to the products of the California-based electronics manufacturing company.”

The majority of the attacks have been focused on the United States. However, roughly a quarter of them have hit organizations in Europe, Asia and Africa, making it a truly global campaign. Stay vigilant. As yet, no clear picture has emerged regarding the ultimate aims and goals of this mystery group.