Source: OTX
Date: 2021-04-07 18:44:33
Threat actor: Unknown
Affected sector: Energy
Attack vector: Phishing
Severity: Medium
Confidence: Low
File hash (FileHash-SHA256): 1be8d33d8fca08c2886fa4e28fa4af8d35828ea5fd6b41dcad6aeb79d0494b67
Description:
As tensions between Azerbaijan and Armenia continue, Malwarebytes Labs continues to see a number of cyber attacks that take advantage of this situation. On March 5th 2021, Malwarebytes Labs reported an actor that used steganography to drop a new .Net Remote Administration Trojan. Since that time, Malwarebytes Labs has been monitoring this actor and was able to identify new activity where the threat actor switched their RAT from .NET to Python. The initial infection vector starts with a document that targets the government of Azerbaijan using a SOCAR letter template as lure. SOCAR is the name of Azerbaijan’s Republic Oil and Gas Company.