Microsoft warns of threat actors targeting organizations with malware-laced ISO and IMG files aimed at delivering a remote access trojan.

Microsoft advanced machine learning threat detection models detected multiple malspam campaigns distributing malware-laced ISO.

Last week experts from Microsoft detected a COVID-19-themed spam campaign, the messages are crafted to trick users into downloading and mounting ISO or IMG file attachments. The bait ISO or IMG files were infected with a strain of the Remcos remote access trojan (RAT).

The campaign was targeting specific sectors using COVID-19 themed lures, the Remcos campaigns appear to be limited and short-lived to avoid the detection.

For example, we detected a Remcos campaign going after small businesses looking to get disaster loans. An email pretending to be from the US Small Business Administration carries a malicious IMG (disk image) attachment that leads to the notorious Remcos RAT. pic.twitter.com/EbI8kxICQG— Microsoft Security Intelligence (@MsftSecIntel) May 4, 2020“We also saw a campaign targeting manufacturing companies in South Korea. Attackers sent target organizations an email that impersonates CDC’s Health Alert Network (HAN) and carrying malicious ISO file attachments. The ISO file contains a malicious SCR file, which is Remcos.” states Microsoft in a tweet.

A more recent Remcos campaign targeted accountants in the US with emails purporting to contain “COVID-19 related updates” for members of American Institute of CPAs. The attachment is a ZIP archive containing the familiar ISO file carrying a malicious SCR file with misleading icon pic.twitter.com/o1FbMUbTBs— Microsoft Security Intelligence (@MsftSecIntel) May 4, 2020Major malspam campaigns monitored by Microsoft include attacks at US small businesses, manufacturing companies in South Korea, and accountants in the US.

In the campaign against US small businesses, the messages pretended to be from the US Small Business Administration (SBA), carrying a malicious IMG (disk image) attachment. The IMG file contained an executable file that uses a misleading PDF icon, which once executes start the Remcos RAT infection.

In the campaign that targeted manufacturing companies in South Korea, threat actors impersonate CDC’s Health Alert Network (HAN). The attacks employed ISO file attachments containing a malicious SCR file used to install the Remcos RAT.

The third campaign observed by Microsoft targeted accountants in the US, in this case with COVID as lures. The messages pretend to provide “COVID-19 related updates” for members of the American Institute of CPAs. In this case, attackers used a ZIP archive containing a ISO file carrying a malicious SCR file with a misleading icon.

At the time it is still unclear the end goal of the malspam campaigns, the combination of a specific type of attachment and the exploitation of COVID-19 as a lure characterized this malspam.

Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERShttps://docs.google.com/forms/d/e/1FAIpQLSe8AkYMfAAwJ4JZzYRm8GfsJCDON8q83C9_wu5u10sNAt_CcA/viewform

window._mNHandle = window._mNHandle || {};
window._mNHandle.queue = window._mNHandle.queue || [];
medianet_versionId = “3121199”;

try {
window._mNHandle.queue.push(function () {
window._mNDetails.loadTag(“762221962”, “300×250”, “762221962”);
});
}
catch (error) {}

Pierluigi Paganini

(SecurityAffairs – COVID-19, malspam)

The post Microsoft spotted multiple malspam campaigns using malware-laced ISO and IMG files appeared first on Security Affairs.