Threat Campaign by Molerats uses NimbleMamba Malware to target Middle East
Threat Campaign by Molerats uses NimbleMamba Malware to target Middle East
THREAT LEVEL: Red.
For a detailed advisory, download the pdf file here
An APT group Molerats associated with Gaza has launched a new threat campaign using a malware NimbleMamba aimed at Middle Eastern governments, foreign policy think tanks, and even a state-owned airline.
The current attack was initiated by spear-phishing emails including links to malware files. Later attacks entice users to download malware files by redirecting them to Dropbox URLs and WordPress sites. Geofencing techniques were employed by the attackers to ensure that only inhabitants of the target nations were directed to the landing page. The final payload was a malicious RAR file containing the NimbleMamba malware and, on occasion, a trojan called ‘BrittleBush.’
NimbleMamba has the typical capabilities of an intelligence-gathering trojan, taking screenshots and acquiring process information from the host computer. Additionally, it can detect user interaction, such as looking for mouse movement. The malware also uses the Dropbox API for both C2 as well as exfiltration.
The Techniques commonly used by Molerats are:
TA0001: Initial Access
TA0002: Execution
TA0003: Persistence
TA0004: Privilege Escalation
TA0005: Defense Evasion
TA0006: Credential Access
TA0007: Discovery
TA0011: Command and Control
T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1059.001: Command and Scripting Interpreter: PowerShell
T1059.005: Command and Scripting Interpreter: Visual Basic
T1059.007: Command and Scripting Interpreter: JavaScript
T1555.003: Credentials from Password Stores: Credentials from Web Browsers
T1140: Deobfuscate/Decode Files or Information
T1105: Ingress Tool Transfer
T1027: Obfuscated Files or Information
T1566.001: Phishing: Spearphishing Attachment
T1566.002: Phishing: Spearphishing Link
T1057: Process Discovery
T1053.005: Scheduled Task/Job: Scheduled Task
T1218.007: Signed Binary Proxy Execution: Msiexec
T1553.002: Subvert Trust Controls: Code Signing
T1204.001: User Execution: Malicious Link
T1204.002: User Execution: Malicious File
Actor Details
Indicators of Compromise (IoCs)
References
