The research team at Prevailion has detected and analyzed Linux and Windows remote-access trojans associated with the advanced threat actor known as “HydSeven.” This threat group initially maintained a relatively low profile through the use of bespoke commodity malware. However, they caught the attention of the information security community when performing a highly targeted spear-phishing operation in the summer of 2019.
The team at Prevailion has uncovered new details concerning “MasterMana Botnet,” an ongoing cyber-crime campaign that hits all of the cyber bingo buzzwords: business email compromise, backdoors, and cryptocurrency wallets. There are indications this operation — which targeted corporations around the world for less than the cost of a night at the baseball park — was still active as late as 24 September 2019.
In what is assessed to be an expansion of a coordinated effort to target U.S.-based entities, an emerging and increasingly sophisticated campaign employing obscure file formats poses significant risk — and highlights the need for vigilance around third-party relations.