EastWind Spear-Phishing Storm: Russian IT Under Siege by Sneaky Trojans and Backdoors
EastWind campaign targets Russian IT with backdoors and trojans via spear-phishing. Malicious LNK files exploit DLL side-loading, deploying malware like GrewApacha and CloudSorcerer. New implant PlugY supports multiple communication protocols. Kaspersky highlights the use of popular services for command servers and a watering hole attack with the CMoon worm.
Hot Take:
Looks like the Russians just took a vacation to the malware-filled coast of EastWind. They might need a bigger umbrella for all this cyber-rain!
Key Points:
- EastWind spear-phishing campaign targets Russian government and IT organizations.
- Attack chain initiated via RAR archive with LNK file, leading to malware deployment.
- Malware includes GrewApacha, updated CloudSorcerer, and new implant PlugY.
- Malware uses DLL side-loading and Dropbox for communication and payload delivery.
- CMoon worm linked to watering hole attack, targeting gas supply site in Russia.
Already a member? Log in here