Cobalt Strikes Again, Spam Runs Target Russian Banks

Apart from using a different vulnerability (CVE-2017-8759), what’s unique in their latest spear phishing campaigns, compared to their previous spam runs and even other related cybercriminal campaigns, is an apparent role change.

The second, which ran from September 20 to 21, used an exploit for CVE-2017-8759 (patched last September), a code injection/remote code execution vulnerability in Microsoft’s .NET Framework.

server, which is actually a backdoor Some of the backdoor’s commands are: d&exec — download and execute PE file more_eggs — download additional scripts gtfo — delete files/startup entries and terminate more_onion — run additional script more_power — run command shell commands Infection Chain via CVE-2017-8759

Infection chain using CVE-2017-8759

Spam emails whose attachments contain an exploit for CVE-2017-8759