Analysis & Insights

Finance

Hacker Group TA554 Pairs SLoad And Ramnit Banking Trojan In UK and Italy Attacks

31 December - 8 January 2019

Hacker group TA554 has been using the sLoad dropper to distribute the Ramnit banking trojan in attacks targeted at financial institutions in the UK and Italy.
Cyber_News_Finance
Hacker group TA554 has been using the sLoad dropper to distribute the Ramnit banking trojan in attacks targeted at financial institutions in the UK and Italy. Victims received a spear phishing email that contained a link to a compromised website, which downloaded a zip file with a .lnk shortcut file. Opening the .lnk file then run PowerShell with obfuscated commands and downloaded the sLoad dropper, which manipulated BITSAdmin and certutil to install Ramnit. To avoid detection, TA554 uses a combination of built-in Windows products, including PowerShell, BITSAdmin, and certutil.

References:
[1] Banking Trojan Delivered By Lolbins: How the Ramnit Trojan Spreads Via SLoad In A Cyberattack
 
 

More Weekly Cyber Newsanalysis and insights

Finance

Hacker Group TA554 Pairs SLoad And Ramnit Banking Trojan In UK and Italy Attacks

31 December - 8 January 2019

Hacker group TA554 has been using the sLoad dropper to distribute the Ramnit banking trojan in attacks targeted at financial institutions in the UK and Italy.
Cyber_News_Finance
Hacker group TA554 has been using the sLoad dropper to distribute the Ramnit banking trojan in attacks targeted at financial institutions in the UK and Italy. Victims received a spear phishing email that contained a link to a compromised website, which downloaded a zip file with a .lnk shortcut file. Opening the .lnk file then run PowerShell with obfuscated commands and downloaded the sLoad dropper, which manipulated BITSAdmin and certutil to install Ramnit. To avoid detection, TA554 uses a combination of built-in Windows products, including PowerShell, BITSAdmin, and certutil.

References:
[1] Banking Trojan Delivered By Lolbins: How the Ramnit Trojan Spreads Via SLoad In A Cyberattack
 
 

More Weekly Cyber Newsanalysis and insights