✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Advisory – ICS: Siemens JT2Go and Teamcenter Visualization

May 28, 2021
Rewterz

Rewterz Threat Alert – Dridex Banking Malware – Active IOCs

May 28, 2021

Rewterz Threat Advisory – Russian SolarWinds hackers launch new phishing campaign

Severity

High

Analysis Summary

More than 150 organizations have been attacked by the Russian Hacker group involved in the SolarWinds breach. A new spearphishing campaign has been identified targeting different organizations in a different score of countries. Threat group UNC2452 which is also known as Dark Halo, and Solorigate, targeted government agencies involved with foreign policy, and international development organizations. It is said that around 3000 emails used by 150 organizations were being sent to different organizations in 24 countries.

Attack Analysis

The email contained a malicious hyper text markup language (HTML) attachment that would execute JavaScript code.That code writes an ISO disc image file to a computer’s storage, with the target being encouraged to open it.Once the user had been tricked into clicking on the ISO image which would mount it, an .LNK shortcut executed an included dynamic link library (DLL) file, which in turn runs an instance of the Cobalt Strike Beacon command and control module.

Impact

  • Information theft
  • Exposure of sensitive data

Remediation

  • Always be suspicious about emails sent by unknown senders.
  • Never click on links/attachments sent by unknown senders.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo