Cisco IronPort

Finance-themed emails found in environments protected by Cisco Ironport and Microsoft ATP deliver an attached PDF that contains a link to a WSF script. When run, the WSF is used to a chain of a JSDropper, Malicious Batch Script, Python Installer, and VBS scripts that run multiple instances of DcRAT, Async RAT, Pure RAT, and Venom RAT in memory. At the time of analysis, additional payloads from other campaigns have been found.

Australian Taxation Office-spoofing, taxes-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an attached PDF that contains an embedded link to a Malicious Downloader. The downloader is used to deliver ConnectWise RAT.

IRS-spoofing, taxes-themed, campaign found in environments protected by Cisco IronPort and Trend Micro delivers ConnectWise RAT via an embedded URL.

IRS-spoofing, taxes-themed, campaign found in environments protected by Cisco IronPort delivers ConnectWise RAT via an embedded URL.

Fidelity-spoofing campaign found in environments protected by Microsoft ATP and Cisco IronPort delivers Itarian RAT via an embedded URL.

Taxes-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver a Nullsoft Installer via an embedded URL to an Adobe-spoofing site. The Nullsoft Installer delivers Datto RMM.

Booking.com-spoofing emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a fake CAPTCHA website that delivers a malicious PowerShell Script to the clipboard. When run, the script delivers PureRAT.

Griffin Editions-spoofing emails found in environments protected by Microsoft ATP, Proofpoint, Cisco IronPort, and Check Point delivers Sectop RAT via an embedded URL to a fake CAPTCHA that prompts to run a PowerShell script from clipboard.

Social Security Administration-spoofing emails found in environments protected by Microsoft ATP and Cisco IronPort deliver a ConnectWise RAT via an embedded URL.

Document-themed emails found in environments protected by Cisco IronPort and Mimecast deliver a Nullsoft Installer via an embedded URL. The Nullsoft Installer delivers Datto RMM.

Taxes-themed emails found in environments protected by  Cisco IronPort deliver an attached PDF with a link to download Coro RAT.

Deutsche Telekom-spoofing emails deliver a URL Shortcut File via an embedded URL. The URL Shortcut File delivers an LNK Downloader which delivers a WSF script which delivers a JSDropper. The JSDropper delivers multiple Malicious Batch Scripts. The Malicious Batch Scripts deliver a Python Installer which runs XWorm RAT.