March 12, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Malicious Covid-19 URLs
March 2, 2021Rewterz Threat Alert – Operation Exchange Marauder: Active Exploitation of Multiple Zero-Days
March 3, 2021Rewterz Threat Alert – Malicious Covid-19 URLs
March 2, 2021Rewterz Threat Alert – Operation Exchange Marauder: Active Exploitation of Multiple Zero-Days
March 3, 2021
Severity
High
Analysis Summary
Following samples of Lazarus group, an state sponsored threat actor targeting financially organizations for their gains have been active again and actively targeting different organizations via phishing emails dropping malicious word documents which enables macro when downloaded and executed. Previously these campaigns were specifically crafted to target Russian organizations but now they’ve shifted their tilt towards Asia pacific region.
Impact
- Information theft
- Exposure of sensitive data
- Data exfiltration
Indicators of Compromise
Filename
- Report (March 2021)[.]zip
MD5
- 1cf4fc4377d56db74b7a5a5f0a28b4e9
SHA-256
- 5b2feafef96ca2c77dc40bc3f287bbe30dc0af5829b4d36050d9776d996f23cb
SHA1
- 63b82c487f1d4b81cf6b2fdfb96f4c7435677d80
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.
- Always be suspicious about emails sent by unknown senders.
- Never click on links/attachments sent by unknown senders.