TTL OSINT

Fraudulent Slack ad shows malvertiser’s patience and skills

The article discusses a recent malvertising campaign that targeted the Slack communication tool. The attackers used contextualized detection to narrow down their victims' list and evade detection. The ad appeared legitimate but would only redirect to a click tracker before finally leading to a malicious page impersonating Slack. The campaign involved several layers of deception and used a server previously used by SecTopRAT, a remote access Trojan with stealer capabilities. Malwarebytes has improved its detection coverage and reported the malicious ad to Google. The decoy domains abusing Cloudflare's services have been flagged as phishing. The article highlights the challenges in evaluating ad campaigns and the importance of using specific tooling and knowledge of threat actors' tactics, techniques, and procedures (TTPs).

Disclaimer: This article is part of X-Force OSINT Advisories automated collection to enable faster integration of open-source articles to client environments. All credit and copyright goes to the original authors.

Reference:https://www.malwarebytes.com/blog/cybercrime/2024/08/fraudulent-slack-ad-shows-malvertisers-patience-and-skills

Sample Indicators of Compromise:

• 59e5e07ffa53ad721bc6b4c2ef435e08ae5b1286cda51415303978da474032d2
• slacklink.sng.link
• zoom2024.online
• 45.141.87.218
• slack-windows-download.com

Следите за киберугрозами вместе с экспертами CRATU!
Анализ реальных атак, техники APT-групп, новые уязвимости, практические рекомендации по детекту и доля иронии — всё, как вы любите.

CRATU — ваш инсайдерский источник по кибербезопасности. Подписывайтесь на наш Telegram-канал