Phishing

Intrusions involved the delivery of phishing emails with malicious RAR or ISO attachments, with the former triggering direct DBatLoader execution and the latter obscuring a Windows batch script with a PEM-encoded certificate revocation list-masquerading DBatLoader executable.

Attackers leveraged agreement-spoofing phishing emails to deliver a RAR archive with a malicious DLL, which would execute DSDownloader.

Intrusions commence with the delivery of phishing emails with an HTML file, which when clicked prompts a OneDrive connection failure notice that includes "How to fix" and "Details" options, according to a Trellix analysis.

Attacks by SideWinder, also known as APT-C-17, Razor Tiger, Baby Elephant, and Rattlesnake, involved the delivery of spear-phishing emails with sexual harassment, salary reduction, and employee termination lures that include malicious Word documents.

Millions of phishing emails impersonating IBM, Nike, Coca-Cola, and other major organizations have been deployed through the abuse of a Proofpoint email routing vulnerability as part of the EchoSpoofing attack campaign that began in January, reports The Hacker News.

The campaign lured targets into downloading a fraudulent CrowdStrike Crash Reporter tool as a ZIP file with a trojanized InnoSetup installer.

Investigation into the incident, which may have been caused by a successful phishing attack, is still underway, reported officials, who noted that the recovery of impacted law enforcement systems is being prioritized.

Intrusions involved the use of the domain, crowdstrike-office365[.]com, to lure users into downloading a recovery tool purportedly addressing update-related boot loop issues but delivers a malware loader.