An unidentified actor or actors are tricking victims into opening malicious Excel attachments in phishing emails by showing them stolen sensitive information, reports The Hacker News.
In its report, cybersecurity firm Qualys claims that the attackers appear to have stolen information including Colombian Cedula numbers, customer names, email addresses, telephone numbers, salary details, addresses, and payment records by gaining access to a Colombian cooperative bank's IT infrastructure, which they use to lure victims into opening the attachment.
In addition to the bank data, the Excel file contains a macro that when activated downloads a second-stage DLL payload programmed to retrieve and execute BitRAT on the infected host.
"It uses the WinHTTP library to download BitRAT embedded payloads from GitHub to the %temp% directory," according to Akshat Pradhan, a researcher at Qualys, which first found signs of the activity upon discovering a database dump with 418,777 records allegedly obtained by exploiting SQL injection faults.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.