Hackers Posing as Law Firms Phish Global Orgs in Multiple Languages
ID: 0a3e342a-26fc-5db3-a751-294ad59a70e1
STIX ID: report--0a3e342a-26fc-5db3-a751-294ad59a70e1
Feed Name: Dark Reading
Threat Score
Narwhal Spider (aka TA544 / Storm-0302) executed a wide phishing campaign delivering malicious PDFs disguised as legal invoices (filename pattern like "Invoice_[number]_from_[law firm name].pdf") that deploy loaders such as WikiLoader and likely follow-on payloads including Remcos RAT and IcedID; the campaign exploited a Windows SmartScreen one-day issue, targeted organizations across Italy, the US, Canada and Europe, and emphasizes detection of unusual traffic and employee phishing training.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.