A CyCon U.S. conference flier has been found to be used as a decoy for the spreading of malware intended to steal user information, the NATO Cooperative Cyber Defense Centre of Excellence (CCDCOE) reports. The malware was discovered by the Cisco Talos blog and was supposedly sent out by cyberespionage actor Group 74.
While not taking advantage of software vulnerability, the malware instead crafts and enables malicious code via user interaction.
The malware’s shell takes the form of a Word document advertising the Nov. 7-8 CyCon U.S. conference organized by the Army Cyber Institute at West Point and NATO CCDCOE. Furthermore, the malware is under the file name Conference_on_Cyber_Conflict.doc and is comprised of a “dropper,” which launches viruses through installation, and a “payload” or the malicious activity of the virus itself. Droppers disguise themselves within computer systems and because of their relative newness, many anti-virus programs are not yet equipped to detect it.
The CyCon ad was confirmed by NATO CCDCOE to be fake and the malware technique is one typically used for delivering APT (advanced persistent threat) malware to high-ranking cybersecurity officials. APTs are designed to circumnavigate cybersecurity defenses by using multiple vectors and entry points to quickly breach a network and remain undetected for months at a time.
NATO CCDCOE head of communications Kadri Kutt outlined some measures to protect users from the aforementioned ATPs. They ask users not to run macros, or programmable patterns that translate specific inputs into preset outputs, and to pay attention to Microsoft Office software alerts. They further emphasize the need to carefully handle information obtained from the web and to regularly implement anti-virus software updates.
