Cisco IronPort

TurboTax-spoofing, taxes-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to an Adobe-spoofing site that delivers ConnectWise RAT.

Finance-themed emails found in environments protected by Cisco IronPort, Proofpoint, and Microsoft ATP deliver an embedded link to an archive file containing a Living Off the Land Binary Loader. When run, the loader delivers a Python Installer that runs PureRAT in memory.

HR-themed emails found in environments protected by Cisco IronPort deliver an attached PDF that contains a link to a VBS script that downloads Action1 RAT.

Finance-themed emails found in environments protected by Abnormal Security, Cisco IronPort, Proofpoint, and Microsoft ATP deliver an embedded link to an archive file containing a Living Off the Land Binary Loader. When run, the loader delivers a Python Installer that runs PureRAT in memory.

Response-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a Zoom-spoofing website that delivers HatchConnect.

Response-themed emails found in environments protected by Abnormal Security, Cisco IronPort, and Microsoft ATP deliver an embedded link to a Zoom-spoofing website that delivers a Malicious Batch Script that downloads Action1 RAT.

Meta-spoofing, copyright-themed emails found in environments protected by Abnormal Security, Cisco IronPort, and Microsoft ATP deliver an embedded link to a Meta-spoofing Credential Phishing site.

Copyright-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to PureRAT.

WeTransfer-spoofing, document-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an archive containing a Malicious Batch Script and several files, including legitimate ones, via an embedded URL. The Malicious Batch Script runs an AutoIT Script which runs XWorm RAT in memory.

United States Courts-spoofing, legal-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a JSDropper that delivers ConnectWise RAT.

Travel assistance-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to an archive file that contains an LNK file. When run, the LNK file downloads a PowerShell script that runs TONResolver.

Finance-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an attached PDF with a link to download an LNK Downloader. The LNK Downloader delivers a Malicious Downloader which delivers a Malicious Batch Script which delivers a PowerShell Script. The PowerShell Script runs DcRAT, PureRAT, and XWorm RAT in memory.