✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – New CPDoS Web Cache Poisoning Attacks Impact Sites Using Popular CDNs

October 23, 2019
Rewterz

Rewterz Threat Alert – MedusaLocker Ransomware Infecting Victims Worldwide

October 23, 2019

Rewterz Threat Alert – Lazarus APT Group Drops Malicious PowerShell Scripts – IoCs

Severity

High

Analysis Summary

Fresh attack samples have been retrieved which are suspected to be from the Lazarus APT group. The threat actor is dropping malicious PowerShell script through embedded macros.

Impact

  • Unauthorized System Access
  • Credential Theft
  • Theft of Sensitive Information

Indicators of Compromise

MD5

  • 6850189bbf5191a76761ab20f7c630ef
  • 601b672f7139615f925a2eec792aa9d5
  • bac54e7199bd85afa5493e36d3f193d2

SHA256

  • a7ff0dfc2456baa80e6291619e0ca480cc8f071f42845eb8316483e077947339
  • 735365ef9aa6cca946cfef9a4b85f68e7f9f03011da0cf5f5ab517a381e40d02
  • 6f7a5f1d52d3bfc6f175bf2bbb665e4bd99b0453e2d2e27712fe9b71c55962dc

SHA1

  • b512698ecc9bd603d02e9b6a7e1b7b67ba642a42
  • 0b12e7f03248f8ecef86ce2c6f75d2d30555608c
  • 428f1ef151ef6b60e345a5cb72204f32c34745b4

URL

  • hxxps://crabbedly[.]club/board.php
  • hxxps://craypot[.]live/board.php
  • hxxps://indagator[.]club/board.php

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download files from untrusted sources and do not enable macros.
  • Keep all systems and software updated and patched to latest secure versions.
  • Implement employee awareness programs warning against phishing, social engineering and malvertising attacks.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo