SecureWorks  CTU discovered the Cueisfry downloader trojan while analyzing a spearphishing email sent to an intelligence-related group in Japan.

APT Campaign Leverages the Cueisfry Trojan and Microsoft Word Vulnerability CVE-2014-1761 

Attackers typically rely on large botnets to generate DDoS traffic; however, there are additional ways to amplify attack traffic.

DNS Amplification Variation Used in Recent DDoS Attacks (Update)

Param

セキュアワークスの緊急インシデント対応チームが直ちにに出動し、サイバーインシデントやデータ漏洩リスクへの対応および修復のサポートを24時間体制で提供します。お電話は24時間いつでも受付けています。

メニューや検索機能をご利用いただくか、URLを再確認してください。

Secureworksのホームページはこちら

script-src 'self' 'nonce-#nonce#' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-lVilk2e8qE1rxMg9jxL8K48EwZUpx7Xrf/mm/A5yXWM=' 'sha256-DIygzAg/0fLKA/hDn0YGU7s62O7L/lceyCzUXjE3Pps=' https://code.jquery.com https://pages.secureworks.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://content.secureworks.jp https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://script.crazyegg.com https://hammock.hotprofile.biz https://*.hotprofile.biz https://*.hot-profile.com https://*.on24.com https://*.ceros.com https://*.redditstatic.com https://*.ensighten.com https://*.ml314.com https://*.choozle.com https://*.bluekai.com https://cdn.bizible.com https://cdn.bizibly.com https://ws-assets.zoominfo.com https://ws.zoominfo.com https://insight.adsrvr.org https://js.adsrvr.org https://*.clarity.ms https://static.ads-twitter.com https://cdn.pdst.fm https://*.cloudfunctions.net https://tag.demandbase.com https://*.bidr.io https://*.company-target.com https://www.teads.com https://p.teads.tv https://www.facebook.com connect.facebook.net; img-src 'self' https://*.teads.tv https://*.jsdelivr.net *.hot-profile.com reviews.static.gartner.com dam.secureworks.com *.vidyard.com cdn.jsdelivr.net googleads.g.doubleclick.net content.secureworks.com *.secureworks.jp id.rlcdn.com *.googletagmanager.com cdn.cookielaw.org *.gstatic.com optanon.blob.core.windows.net web.secureworks.com bat.bing.com *.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com *.adslinkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.redditstatic.com alb.reddit.com *.ensighten.com ml314.com *.choozle.com *.bluekai.com cdn.bizible.com cdn.bizibly.com tracking.monsido.com *.clarity.ms analytics.twitter.com t.co *.bidr.io *.company-target.com www.facebook.com t.teads.tv https://ssl.gstatic.com *.secureworks.com *.secureworks.jp https://www.gstatic.com blob: data:; frame-ancestors 'self' *.folloze.com https://calculator.value-cloud.com *.secureworks.com *.secureworks.jp; worker-src 'self' blob: data:;

RELATED BLOGS

APT Campaign Leverages the Cueisfry Trojan and Microsoft Word Vulnerability CVE-2014-1761