Source: OTX
Date: 2021-04-07 18:44:33
Threat actor: Unknown
Affected sector: Energy
Attack vector: Phishing
Severity: Medium
Confidence: Low
File hash (FileHash-SHA256): 42f5f5474431738f91f612d9765b3fc9b85a547274ea64aa034298ad97ad28f4
Description:
As tensions between Azerbaijan and Armenia continue, Malwarebytes Labs continues to see a number of cyber attacks that take advantage of this situation. On March 5th 2021, Malwarebytes Labs reported an actor that used steganography to drop a new .Net Remote Administration Trojan. Since that time, Malwarebytes Labs has been monitoring this actor and was able to identify new activity where the threat actor switched their RAT from .NET to Python. The initial infection vector starts with a document that targets the government of Azerbaijan using a SOCAR letter template as lure. SOCAR is the name of Azerbaijan’s Republic Oil and Gas Company.