انتقل إلى المحتوى الرئيسي
English
logo

NCSC-TAD-2112-001

مستوى الخطورة: حرجة
برمجيات خبيثة

الرقم المرجعي: NCSC-TAD-2112-001CVSS 0

WIRTE Campaign Targets Middle East Entities

نوع التهديد:
غير متوفر
مستوى المشاركة (TLP):
CLEAR
CVE:
غير متوفر

نظرة عامة

A threat group known as WIRTE targets several entities in the Middle East by sending phishing emails containing malicious Excel/Word documents. The Excel droppers use Excel 4.0 macros to generate a VBS script with embedded PowerShell code to download payloads and receive commands from command-and-control servers. The attackers collect system information, identify installed antivirus software, check administrative privileges, and take screenshots. Cloudflare is used to disguise the IP addresses of their

التقنيات المتأثرة

  • Microsoft Office Word and Excel
  • Excel 4.0 macros
  • VBS and PowerShell

إجراءات الحد من المخاطر والإجراءات الفورية

  1. 01

    Email content filtering. Whitelist allowed attachment types (including archives and nested archives). Analyse/sanitize hyperlinks, PDF, and Microsoft Office attachments. Quarantine Microsoft Office macros.

  2. 02

    Application whitelisting of approved/trusted programs to prevent execution of unapproved/malicious programs including .exe, DLL, scripts.

  3. 03

    User application hardening. Configure web browsers to block Flash (ideally uninstall it), ads, and Java on the Internet.

  4. 04

    Web content filtering. Whitelist allowed types of web content and websites with good reputation ratings. Block access to malicious domains and IP addresses, ads, anonymity networks, and free domains.

  5. 05

    Protect your workstations and servers. We continue to encourage customers to follow our Protect Your Computer guidance of enabling a firewall, getting software updates, and installing antivirus software.

المراجع