This latest APT highlights the levels of sophistication attackers will go to just to establish persistence, infect the endpoint, and steal credentials from the victim organization.
Discovered between mid-2019 and January of this year, security researchers identified a set of spear phishing emails that contain malware attributed to a known Iranian advanced persistence threat (APT) group. Focused on organizations in Iraq, Jordan, Turkey, Azerbaijan, and Georgia, these attacks appear to be retaliation for recent geopolitical events.
The attack utilizes a significant number of steps and tools found on Windows endpoints to avoid detection by email scanning tools and endpoint antivirus. The steps are as follows:
- A phishing email is received
- The user opens a ZIP attachment
- The attachment contains an Excel File
- The user enables macros
- The macro opens a Command Prompt
- A batch file is run
- A PowerShell script is launched
- The Forelord malware is executed
Once running, Forelord downloads several of its own tools to collect credentials, test those credentials on the network, and establish an SSL tunnel to allow remote access.
As with most spear phishing attacks, the first step above is where you should place your security focus; if you stop the attack at step 1, the remainder of the attack never happens. Users educated with Security Awareness Training aren’t fooled by emails asking user to open ZIP files (who sends ZIP files these days anyways???). Instead, they are vigilant enough to spot suspicious aspects of an email (such as the odd attachment type) are don’t engage with the content – thus, stopping the attack.
Users are the key to this attack and countless others like it. Leveraging your users as part of your security defense is not only a smart move, but is a necessity to ensure the highest levels of security and lowest levels of risk.
