Fromprodefence.org
prodefence.org
Security researchers observed a new campaign targeting financial institutions and governmental organizations with a customized version of a remote access tool called “Proyecto RAT”.
The payload found to be written in Visual Basic 6 and it uses Disposable E-mail Address service yopmail for its C&C communication. The yopmail is known for creating temporary inboxes.
Infection Process
According to the Trend Micro report, the attack primarily targets the organizations in the South American region, particularly in Colombia. The infection starts with a customized email sent to the target from open or compromised mail servers in the South America region.
The Email contains an RTF attachment file and contains tempting subjects
- “Hemos iniciado un proceso en su contra por violencia laboral.” (Loosely translates to “We have filed a lawsuit against you for workplace violence.”)
- “Se hara efectivo un embargo a su(s) cuenta(s) Bancarias.” (Loosely translates to “Your banking accounts are going to be blocked.”)
- “Almacenes exito te obsequia una tarjeta regalo virtual por valor de $500.000.” (Loosely translates to “Exito shops offer you a virtual gift worth $500.000.”