Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.
If you haven’t yet, there’s still time to register for this year’s Talos Threat Research Summit — our second annual conference by defenders, for defenders. This year’s Summit will take place on June 9 in San Diego — the same day Cisco Live kicks off in the same city. We sold out last year, so hurry to register!
The top news this week is, without a doubt, Sea Turtle. Wednesday, we posted our research related to this DNS hijacking campaign that has impacted countries around the world and is going after government agencies, many dealing with national security. You can check out all the details here. This week’s episode of the Beers with Talos podcast also discusses Sea Turtle.
And while it didn’t grab as many headlines, we also wrote this week about HawkEye Reborn, a variant of the HawkEye malware. The keylogger recently changed ownership, and the new actors behind the malware have recently made a sizable push to infect users.
Also, take a look below to find out new information about LokiBot.
Finally, we also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week.
Location: Salt Lake City, Utah
Synopsis: Join Nick Biasini as he takes part in a day-long education event on all things Cisco. Nick will be specifically highlighting the work that Talos does as one part of the many breakout sessions offered at Cisco Connect. This session will cover a brief overview of what Talos does and how we operate. Additionally, he'll discuss the threats that are top-of-mind for our researchers and the trends that you, as defenders, should be most concerned about.
Description: From mid-February through mid-March, Talos monitored phishing campaigns purporting to be sent from a legitimate domain registered to a large organization in the oil and gas industry. Cisco Talos recently discovered yet another campaign using specially crafted, malicious — yet persuasive — emails to target a legitimate organization in the oil and gas industry in the Middle East. The campaign deploys malware that exhibits similarities to the data-stealing malware families of LokiBot and Formbook. At the end of this newsletter, you’ll see a list of IOCs related to these attacks.
Description: A vulnerability in the way Microsoft Internet Explorer handles MHT files. If a user were to open a specially crafted MHT file, an attacker could gain the ability to exfiltrate local files and carry out additional spying on locally installed program version information. The interaction could even be carried out automatically without any user interaction.
Snort SIDs: 49799, 49800
Keep up with all things Talos by following us on Twitter and Facebook. You can also subscribe to the Beers with Talos podcast, which comes out bi-weekly, here (as well as on your favorite podcast app). And, if you’re not already, you can also subscribe to the weekly Threat Source newsletter here.
plenoils[.]com sharedrive[.]top alkzonobel[.]com web2prox[.]com office[.]webxpo[.]us
84[.]38[.]132[.]25 173[.]198[.]217[.]123 37[.]49[.]225[.]195
hxxps://sharedrive[.]top/?qp hxxp://sunny-displays[.]com:80/old/lk/fre.php hxxp://sunny-displays[.]com/secured/lk/PvqDq929BSxADM1na.php hxxp://modernizingforeignassistance[.]net/wp-content/plugins/projects/we.hta hxxp://37[.]49[.]225[.]195/hook/logs/fre.php
3a5d7cd294848302f16c47735fe6342c1811c4d2309ff1a250d9bad267c2e278 1ace02fe46edcff8d775e3e3865813d204b138ab50e3edf6b94fc0c3afd9e883 7a47388b6d66aadeb16cf86cc27bab61006ee33f561a99d2f54f3e8b7652361e cc63041400a7b39fb0560b1e5ecfe980f0ff4915b473881e203b85a14c192e50 33ae7a8b755786de1e56341449c763fa43861a503937b3de0778188814b0f5f2 7a47388b6d66aadeb16cf86cc27bab61006ee33f561a99d2f54f3e8b7652361e cc63041400a7b39fb0560b1e5ecfe980f0ff4915b473881e203b85a14c192e50 33ae7a8b755786de1e56341449c763fa43861a503937b3de0778188814b0f5f2 45fd204c881bc2002cba8b58eb8f135c8e8f2b290bcede597ab1bd6647028570 8b6819c03ab993eb21adb59f06cb4476eb6ea869f61004b56df7b3a1ee999e28 46a047e141ed8fa151a9e3cf869ed2c56234d0de0b627d998b247150c8f99984 597cab0edaf0034d7aab7b1ecca1bf0dcd25a094cdaf10bca6f7cb38c7f17daf d6e4818a63a1dc2a1887135563c0591bdb4d524b6bd4d37aa5e5051935aa7578
Nasser[.]K[.]@plenoils[.]com g9825@live[.]com mailer@matterbusiness[.]xyz inf0-greenhillsports@outlook[.]de youzs@ropasz[.]ml punker@biven[.]ml otaz@viotaz[.]ml riyanlepine@drylnewby[.]cf webxpoinc@yahoo[.]com chosipongs@gmail[.]com
8-3503835SZBFHHZ
d667c0c158786889fafa273d81bce9980bdc6ab54ea58bd2a558e248598158ac maldoc ae55388db9f39945f3aee9e6c2a66bacfe6483eb83341b0982a6741c83a28a34 maldoc e27d1d4de73d75968cacc3a581e54f71fef372a8661297c59a8d1a8cea60a51d .hta file 8220331b94a0dc7207246b0a2193ba2335bb70c673a085f52de0bb66786c86ce 3497d5897559c595f1ebd982171d74770dd135973eb6ea62f8fad6fec6438acc 2718ac89d522881522af2fb0b552ef55e25308544b594ed64e7f15f31acdec73
62ed293128f4728ef73efb2089d92e68fe21937aca34577d3083d1cda3fab60e bfce7a05c96bf7ffbafa03f283c0fa2bdc13521f9e2f1664cb522d88def782c6 907c57b17f97570704df5391c2f49ff2a13d513f1da95c0f24f34285bb01dfe4 6d4211fe7b01222bfa653dcc9e3eadd542bbd5b03ab44f2c459508eff9acff39 636fd49f53c72528f7a8780ccb4cf064839a9bd29f3f65499f10919ae5939c0a 5b1392ad890381075aeac3ef5839aace8a42460ca80834320a483202656721d6 0ca5a9a87b301d664c16c9237900adf3e12a48c5a36b7d94e4beb99eeaf127d7 7db875e9bf67c66365778004bcb5e502f91e852ad02f99b7be5160350d3edcf2 ff063e2b52f753778ac92eb436e6b35f6255c11970febc9868c29abd2e3fbeac 0ca5a9a87b301d664c16c9237900adf3e12a48c5a36b7d94e4beb99eeaf127d7 ff063e2b52f753778ac92eb436e6b35f6255c11970febc9868c29abd2e3fbeac dea7c0f7d5c7b941d1dbae7f271cec5906fd08d529a5165e4bdb825fd502a79f b9bc454e763b66df9623de4116503f3f1972eaa83beafe062856b214e01dad25 a1f9826d9e376eaca7b6f597fbec52ae6b588d687e083fca09606cbc1bb0ce10 1b60205a11da53b07e53297f26353d65d6e3777de2464b59b73908dec51d8560 3de7152b38fa291592f749037908c01ab85705e138073ede18286dd2ac18fc4a 64fc2ec1ece8ffed4d8d7a94f48fa5ac191b3b7de8a2da8971c75f28aa7dd960 7db875e9bf67c66365778004bcb5e502f91e852ad02f99b7be5160350d3edcf2 e27c409bd463f4d14ee606b71216ef895f8767a6d1845d8a92bd2dd17dd3f797 2acc3bdf6821d27a401376845659040d75dd31d0405da2e1809a22a9b5f65145 461a950af13fe9b1d18c9895b7fa844ab9fcae0b7f17af438bd886fae146502e 97d3a9daa6c215983b340d8b4e8bf89561383e260a2c05f71c6d26014f6bc96d 1c878537a25979839e31f128e8ef4e7f582c196448c8e0e1277f0568e566a067 722be87f72a8e18c0b7f50cdac7e118f64364f519cf59d0b4e0f4798029847d8
b0dc50e22a2c3fe76831f2990dcd7b1b0ca969113c2d0c962d84c5e8b02ae75f maldoc 1365104bee40dc25b0df2e9102961c9fbce10658cce9f15b9f45d0e60e18d3a9 maldoc c08fafb05053df47f2f830d0c6d7fe34be30b13bd2280ab2db6249d7dae6b5fb maldoc
5b3c39e9d85ac947f830ed02988277f6460b991aa050063545cffb147029fd51 maldoc PO58609.doc 811c32c017d340fe1d198ff441b14d95c7101bd04cd4fdeaaaf03124700bf3ef PO58610.doc 1c3c62a64dcb66595eb8140fc73a9e0cbfdc9fe5f73f802489c04a460fa6e6ba