Mexico has been subjected to attacks with a new variant of the Mispadu banking trojan that involved the exploitation of a high-severity Windows SmartScreen vulnerability patched by Microsoft in November, according to The Hacker News.
Malicious ZIP archive files with internet shortcut files have been leveraged by threat actors to target the flaw, tracked as CVE-2023-36025, evade the warnings of SmartScreen, and later distribute Mispadu, which enables geographic and system configuration targeting before conducting data exfiltration activities, a report from Palo Alto Networks' Unit 42 revealed.
Such findings come amid increased remote access trojan targeting against Mexico, as well as a recent Sekoia report detailing the Russian cybercrime operation FIN7's DICELOADER custom downloader, also known as Tirion and Lizar.
"DICELOADER is dropped by a PowerShell script along with other malware of the intrusion set's arsenal such as Carbanak RAT," said researchers, who also noted the downloader's advanced command-and-control IP address concealment techniques.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.