New Threat Actor using Serpent Backdoor attacking French Entities
New Threat Actor using Serpent Backdoor attacking French Entities
THREAT LEVEL: Red.
For a detailed advisory, download the pdf file here
Threat actors are using a new backdoor called Serpent through macro-enabled Microsoft Word documents attacking French entities in sectors such as construction and government. Using this backdoor the attacker could potentially enable remote administration, command & control (C2), data theft or even deliver other additional payloads.
The threat actor targets organizations using phishing mails attached with a macro-enabled Microsoft Word document masquerading as information relating to the European Union’s General Data Protection Regulations (GDPR). Once the macros are enabled in the Microsoft Word, it executes a PowerShell script hidden in an image. The PowerShell script downloads, installs, and updates the Chocolatey installer package and repository script. Now Chocolatey installs Python including several packages and dependencies. Another image file encoded with a Python script is downloaded and saves the Python file as MicrosoftSecurityUpdate.py. The script then creates and executes a .bat file that in turn executes the Python script. The attack chain ends with a command to a shortened URL which redirects to the Microsoft Office help website.
The MITRE TTPs commonly seen are:
TA0011: Command and Control
TA0003: Persistence
TA0009: Collection
TA0005: Defense Evasion
T1027: Obfuscated Files or Information
T1070: Indicator Removal on Host
T1090: Proxy
T1137: Office Application Startup
T1213: Data from Information Repositories
Indicators of Compromise (IoCs)
Reference
