Quote:A wave of targeted cyberattack campaigns bent on espionage is cresting around the globe, using a strain of a 13-year old backdoor trojan named Bandook.
According to Check Point Research, Bandook was last spotted being used in 2015 and 2017/2018, in the “Operation Manul” and “Dark Caracal” campaigns, respectively. The malware then all but disappeared from the threat landscape – but it’s now having a resurgence.
According to the firm, dozens of digitally signed variants of this commodity malware are popping up in an unusually large variety of sectors and locations. Targeted entities include those in the government, financial, energy, food industry, healthcare, education, IT and legal sectors. And, they have been located in Chile, Cyprus, Germany, Indonesia, Italy, Singapore, Switzerland, Turkey and the U.S.
“This further reinforces a previous hypothesis that the malware is not developed in-house and used by a single entity, but is part of an offensive infrastructure sold by a third party to governments and threat actors worldwide, to facilitate offensive cyber-operations,” according to researchers at Check Point, in a recent posting.
In these latest attacks, the malware arrives on targets’ computers in the form of a malicious Microsoft Word document delivered inside a .zip file. Check Point found that the themes of the documents revolve around cloud-based services like Office365, OneDrive and Azure – recipients are promised access to other documents if they click “Enable Content.”
Read more: https://threatpost.com/digitally-signed-...gn/161676/
![[-]](https://www.geeks.fyi/images/collapse.png)
