Excel File Deploys Cobalt Strike at Ukraine


FortiGuard Labs has recently identified a sophisticated cyberattack involving an Excel file embedded with a VBA macro designed to deploy a DLL file.

The attacker uses a multi-stage malware strategy to deliver the notorious “Cobalt Strike” payload and establish communication with a command and control (C2) server. This attack employs various evasion techniques to ensure successful payload delivery. Over the past few years, Ukraine has been a significant target due to its geopolitical situation. The history of these attacks reveals a pattern of increasing complexity and frequency, particularly during periods of geopolitical tension.

Read more…
Source: Fortinet


Sign up for our Newsletter


Related:

  • Ransomware attack shuts down The Superior Court of Los Angeles County

    July 22, 2024

    The Superior Court of Los Angeles County will be closed on Monday as they continue to recover from a ransomware attack that happened last week. Because of this, all 36 courthouse locations across LA County will be closed to start the week as work continues on the repair and reboot of network systems that were shut ...

  • MediSecure reveals 12.9 million Australians had personal data stolen in cyber attack earlier this year

    July 18, 2024

    eScript provider MediSecure has revealed the personal data of 12.9 million Australians was stolen by hackers earlier this year, making it one of the largest cyber breaches in Australian history. MediSecure, which facilitates electronic prescriptions and dispensing, confirmed it was the victim of a large-scale data breach in May. The company had previously not disclosed how ...

  • Disney faces potential data breach, hacker group claims massive leak

    July 15, 2024

    The Walt Disney Company is reeling from a suspected cyberattack by a hacktivist group calling itself NullBulge, exposing a significant amount of sensitive information. NullBulge announced its exploit on 12 July on both the cybercrime forum Breach Forums and X/Twitter. The group said it infiltrated Disney’s internal Slack communication platform, leaking 1.2 terabytes of data online. Read ...

  • Rite Aid confirms data breach following ransomware attack

    July 15, 2024

    American drugstore chain Rite Aid has confirmed that last month’s ransomware attack resulted in data theft. In a statement, the company said it was currently investigating the cyberattack, and is working on sending out data breach notifications to affected customers. “Rite Aid experienced a limited cybersecurity incident in June, and we are finalizing our investigation. We ...

  • I spy another mSpy breach: Millions more stalkerware buyers exposed

    July 14, 2024

    Commercial spyware maker mSpy has been breached – again – and millions of purchasers can be identified from the spilled records.… mSpy showed up on Have I Been Pwned on July 11, with the site revealing hacktivists were responsible for the theft of millions of Zendesk support tickets from buyers unable to use the software. “Comprising ...

  • AI, cyber-attacks and amateur experiments threaten to upend global biosecurity, WHO warns

    July 13, 2024

    Artificial intelligence, cyber-attacks and genetic engineering could pose potentially catastrophic biosecurity threats to countries around the world, the WHO has warned. Rapid technological advances in the past decade have “redefined the biological threat landscape” and heightened risks of manipulation, the updated guidance from the WHO’s Technical Advisory Group on Biosafety said. The report advised that member ...