The Latest Cloud Hosting Service to Serve Malware
ID: e1ce2b4d-c058-56a4-8a1b-a1f6922026aa
STIX ID: report--e1ce2b4d-c058-56a4-8a1b-a1f6922026aa
Feed Name: Zscaler Security Research Blog
Threat Score
Zscaler ThreatLabz describes a cloud-hosting abuse campaign (hosted on Cogeco Peer 1 IPs) that distributed a malicious Word document (resume_ahmadhammouz.doc) with an embedded macro which downloads a packed Delphi crypto-wallet stealer that exfiltrates system info and searches for various cryptocurrency wallet files, and separately served Microsoft and DocuSign phishing pages; the report provides technical analysis, C2 communication details, screenshots, and multiple IOCs (file hashes, URLs, IPs).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.