banner



Threat actor Patchwork accidentally attacked itself with a RAT

Patchwork, a threat player based in Republic of india, accidentally infected itself with a Remote Administration Trojan (RAT). The ironic incident was discovered by Malwarebytes, which took the opportunity to gain insight as to how Patchwork utilizes RTF files to spread the BADNEWS (Ragnatela) RAT.

"Ironically, all the data we gathered was possible thanks to the threat role player infecting themselves with their ain RAT, resulting in captured keystrokes and screenshots of their own figurer and virtual machines," explained Malwarebytes.

As part of a contempo attack, Patchwork spread malicious files by impersonating Pakistani authorities. Documents were sent out equally attachments that appeared to be legitimate and important. Instead, the files contained an exploit that tin can compromise a calculator and then execute the RAT.

The post-obit organizations were successfully compromised by the efforts of Patchwork, according to Malwarebytes:

  • Ministry building of Defence force- Government of Islamic republic of pakistan
  • National Defense force University of Islam Abad
  • Kinesthesia of Bio-Science, UVAS University, Lahore, Islamic republic of pakistan
  • International heart for chemic and biological sciences
  • HEJ Research institute of chemistry, International eye for chemical and biological sciences, univeristy of Karachi
  • SHU University, Molecular medicine

Patchwork likewise infected itself with the RAT, which gave Malwarebytes admission to quite a scrap of data. Malwarebytes was able to see that Patchwork uses VirtualBox and VMWare for development. The security firm also determined that Patchwork uses VPN Secure and CyberGhost to mask its IP accost.

Comedically, Malwarebytes was also able to determine the local atmospheric condition of Patchwork's machines. "Other information that can be obtained is that the weather at the time was cloudy with 19 degrees and that they haven't updated their Coffee yet."

Malwarebytes notes that Patchwork is not as sophisticated as similar attackers in Russia and North korea.

Source: https://www.windowscentral.com/threat-actor-accidentally-infects-itself-its-own-remote-administration-trojan

Posted by: mcdonoughonink1956.blogspot.com

0 Response to "Threat actor Patchwork accidentally attacked itself with a RAT"

Post a Comment

Iklan Atas Artikel

Iklan Tengah Artikel 1

Iklan Tengah Artikel 2

Iklan Bawah Artikel