Spyware Snafu: Cyber Sleuths Expose Bungling Hackers in Espionage Fiasco
Threat hunters have uncovered a new campaign targeting a South American foreign ministry with malware granting remote access. Dubbed REF7707, the campaign features bespoke malware like FINALDRAFT, which uses the Microsoft Graph API for command-and-control purposes. Despite the sophisticated tools, attackers seem to have poor management skills.
Hot Take:
Looks like “REF7707” isn’t just a jumbled set of letters and numbers; it’s a secret code for “We Have No Idea What’s Going On, But We Sure Are Trying!” Who knew a South American foreign ministry could become the world’s most exclusive malware party? I guess everyone wants to RSVP when the invite comes with encrypted shellcode and a side of espionage.
Key Points:
- REF7707 targets include a South American Foreign Ministry, a Southeast Asian university, and a telecommunications entity.
- The attack utilizes Microsoft’s certutil and Windows Remote Management to spread malware.
- PATHLOADER and FINALDRAFT are key malware tools used for remote access and command execution.
- FINALDRAFT uses Microsoft Graph API and Outlook drafts for command-and-control.
- Linux variant of FINALDRAFT discovered, hinting at cross-platform espionage.
Already a member? Log in here