Phishing Campaign Delivers FlawedAmmyy, RMS RATs

[silversurfer]

A new campaign delivering various remote access Trojans (RATs) is likely the work of a known Dridex/Locky operator, Morphisec security researchers warn.

Dubbed Pied Piper, the campaign targets users in multiple countries and is likely operated by TA505, the threat group known to have orchestrated large Dridex and Locky attacks in the past. Observed starting last week, the phishing attempts use documents with malicious macros for malware delivery.

The campaign is multi-staged and still ongoing, with a version delivering the FlawedAmmyy RAT, while another variant dropping the Remote Manipulator (RMS) RAT. Earlier this year, TA505 was observed exploiting an Office zero-day to deliver the FlawedAmmyy RAT.

The attack, Morphisec says, potentially impacts a supplier to well-known food chains such as Godiva Chocolates, Yogurtland and Pinkberry. The campaign could hit others soon, provided the command and control (C&C) servers are not taken down, the researchers say.

Source: https://www.securityweek.com/phishing-ca...y-rms-rats