Government agencies targeted with never before seen malware payload — named SilentTrinity
A mysterious hacker group has targeted, and most likely infected, Croatian government employees between February and April this year.
Attackers, which are suspected to be a state-sponsored unit, have targeted victims using a spear-phishing campaign that mimicked delivery notifications from the Croatian postal or other retail services.
Emails contained a link to a remote website with a lookalike URL, where users were asked to download an Excel document.
USERS TARGETED WITH NEVER-BEFORE-SEEN MALWARE
The document was laced with malicious code packed as a macro script which appeared to have been largely copied off the internet, from various tutorials or open source projects hosted on StackOverflow.com, Dummies.com, Issuu.com, Rastamouse.me, or GitHub.com.
The macro script, if enabled by the victim, would download and install malware on their systems. Two different sets of malware payloads were detected during these attacks.
The first was the Empire backdoor, a component of the Empire post-exploitation framework, a penetration testing utility. The second was SilentTrinity, another post-exploitation tool, similar to the first.
In a presentation at the Positive Hack Days (PHDays) security conference in May, Alexey Vishnyakov, a Senior Specialist in Threat Analysis for cyber-security firm Positive Technologies, said this was the first time when a malicious threat actor had weaponized the SilentTrinity tool in an active malware distribution campaign.
CROATIAN GOVERNMENT DETECTED THE ATTACKS IN APRIL
ZDNET