Microsoft ATP

Copyright-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to PureRAT.

Finance-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an embedded link to a Malicious Batch Script that downloads ConnectWise RAT.

United Healthcare-spoofing, document-themed emails found in environments protected by Trend Micro and Microsoft ATP deliver a JSDropper via an embedded URL. The JSDropper delivers a custom Information Stealer and several legitimate files.

WeTransfer-spoofing, document-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an archive containing a Malicious Batch Script and several files, including legitimate ones, via an embedded URL. The Malicious Batch Script runs an AutoIT Script which runs XWorm RAT in memory.

Docusign-spoofing, document-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an HTA via an embedded URL. The HTA delivers ConnectWise RAT.

United States Courts-spoofing, legal-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a JSDropper that delivers ConnectWise RAT.

Travel assistance-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to an archive file that contains an LNK file. When run, the LNK file downloads a PowerShell script that runs TONResolver.

Shipping-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a virtual hard drive file that contains Moixd Stealer.

Finance-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an attached PDF with a link to download an LNK Downloader. The LNK Downloader delivers a Malicious Downloader which delivers a Malicious Batch Script which delivers a PowerShell Script. The PowerShell Script runs DcRAT, PureRAT, and XWorm RAT in memory.

Notification-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an embedded link to a Credential Phishing site.

Document-themed emails found in environments protected by Abnormal Security and Microsoft ATP deliver an attached PDF that contains an embedded link to a Credential Phishing site.

Resume-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver a malicious Visual Basic Script via an embedded link. When run, the script delivers repurposed Nirsoft password recovery tools via a Malicious Downloader and a Cryptocurrency Coin Miner.