![]() NSIS is an open source tool for creating Windows installers, designed for Internet-based software distribution. In this post, we’ll focus on the initial wave of campaigns, which all used Nullsoft Scriptable Install System (NSIS) installers. This is a shift in tactics, but we suspect that this group constantly changes the way they deploy malware-and that the group has conducted campaigns prior to this past November. This leads us to believe that they are all the work of the same actors-a group we’ve dubbed RATicate.Ī new campaign we believe connected to the same actors leverages concern about the global COVID-19 pandemic to convince victims to open the payloads. The campaigns targeted industrial companies in Europe, the Middle East, and the Republic of Korea. ![]() We’ve identified five separate campaigns between November, 2019 and January, 2020 in which the payloads used similar packing code and pointed to the same command and control (C&C) infrastructure. In a series of malspam campaigns dating back to November of 2019, an unidentified group sent out waves of installers that drop remote administration tool (RAT) and information stealing malware on victims’ computers. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
January 2023
Categories |