Cybersecurity researchers have discovered an ongoing phishing campaign that makes use of a unique attack chain to deliver the XWorm malware on targeted systems.
Securonix, which is tracking the activity cluster under the name MEME#4CHAN, said some of the attacks have primarily targeted manufacturing firms and healthcare clinics located in Germany.
The report builds on recent findings from Elastic Security Labs, which revealed the threat actor’s reservation-themed lures to deceive victims into opening malicious documents capable of delivering XWorm and Agent Tesla payloads.
The attacks begin with phishing attacks to distribute decoy Microsoft Word documents that, instead of using macros, weaponize the Follina vulnerability (CVE-2022-30190, CVSS score: 7.8) to drop an obfuscated PowerShell script.
XWorm is a commodity malware that’s advertised for sale on underground forums and comes with a wide range of features that allows it to siphon sensitive information from infected hosts.
The exact origins of the threat actor are currently unclear, although Securonix said the attack methodology shares artifacts similar to that of TA558, which has been observed striking the hospitality industry in the past.
“Though phishing emails rarely use Microsoft Office documents since Microsoft made the decision to disable macros by default, today we’re seeing proof that it is still important to be vigilant about malicious document files, especially in this case where there was no VBscript execution from macros,” the researchers said.
Source: https://thehackernews.com/
