One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 6145838 |
| Date de publication | 2022-08-05 09:19:20 (vue: 2022-08-05 18:05:31) |
| Titre | Newly Identified Green Stone Malware Leveraging Malicious Macros in Global Campaign |
| Texte | FortiGuard Labs is aware of a campaign targeting Iranian interests, specifically in the energy sector. Dubbed Green Stone, this malware is delivered through Microsoft Excel spreadsheets containing malicious macros. The Green Stone malware is obfuscated in Base64, where the macro code contains instructions to unpack Green Stone into a temporary directory where it is then executed.What is Green Stone?Green Stone is classified as an infostealer, is persistent and will steal information from the affected machine. It will look for specific registry entries in \Microsoft\Internet Explorer\TypedURLs to look for websites that the targeted machine recently visited. Besides containing basic infostealer functionality, Green Stone also connects to Telegram to send C2 traffic through, which is likely a way to evade detection.The threat has the ability to collect information about the victim machine, take screenshots and send it to a predetermined URI. Green Stone can do the following:Scan directory hierarchiesDelete files and folders Run commandsLocate filesRename files and directoriesCopy filesand UnzipBased on our data, connections to the C2 server reveal the United States accounts for 30 percent, Brazil 15 percent and Argentina, Korea and Germany accounting for less than 2 percent of connections to the 185.162.235[.]184 IP address of the attacker. Who is Behind Green Stone?There is not enough information at this time to determine attribution.Any Other Suggested Mitigation?As it has been observed that Green Stone threat actors have used malicious Microsoft Office files, likely through social engineering and phishing techniques, it is recommended to never enable macro based documents, especially from a sender that is not recognized.Due to the ease of disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spear phishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spear phishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.What is the Status of Coverage?Fortinet customers running the latest definitions are protected by the following (AV) signatures:WM/Agent!tr (Malicious Macro)W32/Agent.665F!tr (Green Stone)All network IOC's are blocked by the WebFiltering Client. |
| Envoyé | Oui |
| Condensat | 162 184 185 235 665f ability about access accomplished accounting accounts actors address addressed affected all also always any are argentina assessment attachments attacker attackers attacks attribution aware awareness base64 based basic been behind being besides blocked brazil campaign can caution classified client code collect commandslocate conduct conducted connections connects containing contains could coverage crucial customers daily damage data date definitions delivered department detection determine determined difficulty directoriescopy directory disruption distribution documents don dubbed due ease educate emails employees enable encourage encouraged end energy engineering enough ensure entries especially etc evade excel executed explorer feasible files filesand filesrename folders following following:scan foothold fortiguard fortinet from functionality germany global green has have having help hierarchiesdelete how identifiable identified important impromptu inform information infostealer initial instructions interests internal internet ioc ips iranian keep know known korea labs latest less leveraging likely links look machine macro macros made malicious malware mechanisms microsoft mitigation need network never newly not obfuscated observed office ongoing open operations organization organizations other patching percent persistent personally personnel phishing phishing/spear pii predetermined prevent protect protected recently recognized recommended registry regular release reported reputation reveal risk run running screenshots sector security send sender senders server sessions should signatures signatures:wm/agent simple since social someone spear specific specifically spot spreadsheets states status steal stone suggested take targeted targeting techniques telegram templates temporary tests than then threat through time traffic training treat typedurls types united unpack unrecognized/untrusted unwanted unzipbased updated uri used user users using various vendor victim visited vulnerabilities w32/agent way webfiltering websites well what where which who will within |
| Tags | Malware Threat Patching |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.