Phishing Scheme Targets Russian Users

A new phishing campaign has recently been uncovered, specifically targeting Russian users. It’s a sophisticated attack that employs Amnesia RAT and ransomware to breach systems. According to The Hacker News, cybercriminals behind this campaign use a multi-layered approach, showcasing advanced tactics.

The attackers rely on social engineering to trick users into opening business-themed compressed files. These files contain deceptive documents and a malicious Windows LNK file, which triggers a PowerShell script. This script serves as a preliminary mechanism to gain persistence and discreet access to the system, as Fortinet’s FortiGuard Labs detail. Once active, the malware alters settings to disable Microsoft Defender scans and uses PowerShell for further exploitation. It also performs environmental reconnaissance and disables Windows admin tools before deploying Amnesia RAT and a ransomware payload based on Hakuna Matata.

The Threat of Amnesia RAT

The Amnesia RAT, downloaded from Dropbox, is designed for extensive data theft. It targets browsers, cryptocurrency wallets, and apps like Telegram and Discord. Meanwhile, the ransomware encrypts various files, including documents and source code. Researcher Cara Lin notes that this attack sequence shows how modern malware can fully compromise a system without exploiting known software vulnerabilities.

For strategies to defend against such threats, explore our comprehensive guide on ransomware defense.

Subscribe for the latest cybersecurity insights and updates directly to your inbox. By subscribing, you agree to our terms of use and privacy policy.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.