2021-04-16 (FRIDAY) - TA551 (SHATHAK) GERMAN-TEMPLATE WORD DOCS PUSH URSNIF (GOZI/ISFB)
ASSOCIATED FILES:
- 2021-04-16-TA551-IOCs-for-Ursnif.txt.zip 4.9 kB (4,936 bytes)
- 2021-04-16-TA551-malspam-2-examples.zip 306 kB (305,863 bytes)
- 2021-04-16-TA551-Word-docs-62-examples.zip 8.6 MB (8,647,277 bytes)
- 2021-04-16-TA551-installer-DLL-and-HTA-files.zip 3.9 MB (3,947,088 bytes)
- 2021-04-16-Ursnif-related-files-from-an-infected-host.zip 2.2 MB (2,287,699 bytes)
- 2021-04-16-TA551-Ursnif-traffic.pcap.zip 2.8 MB (2,785,050 bytes)
NOTES:
- Starting this week, the TA551 (Shathak) campaign switched to German-language templates for their Word docs and targeted German-speaking victims.
- TA551 was active earlier this week on Tuesday 2021-04-13 and Wednesday 2021-04-14, also targeting German-speaking victims.
- All zip archives on this site are password-protected. If you don't know the password, see the "about" page of this website.
Click here to return to the main page.