NOROBOTMalware
- baitswitch
Last reported 25 days ago, by The Hacker News2 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1053.005Scheduled Task
“RedFlick uses scheduled tasks, jobs that Windows runs automatically, to install a backdoor named CosmicPulse.”
- T1218.002Control Panel
“The third uses control.exe, the Windows Control Panel program, to run the next stage from the C2 server.”
- T1036Masquerading
“…ved an MSI installer creating a scheduled task that uses control.exe to download and execute a remotely hosted CosmicPulse downloader masquerading as a Control Panel applet (CPL).”
- T1136Create Account
“Using compromised websites to create accounts to send phishing emails”
- T1556.009Conditional Access Policies
“Lockdown account access using Conditional Access policies.”
- T1564.003Hidden Window
“When the victim opens the LNK file, conhost.exe is launched in a hidden window and cmd.exe is subsequently spawned to execute the embedded BAT script:”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor“The downloader is the one earlier reports called NOROBOT or BAITSWITCH.”
-
Star Blizzard refines phishing and malware delivery with the RedFlick technique“The downloader is also known publically as NOROBOT or BAITSWITCH.”
Indicators in its reports
named in the reports above- 103.160.59[.]97in 2 reports
- secure-dns-hub[.]comin 2 reports
- 103.245.231[.]248in 1 report
- 2.57.241[.]246in 1 report
- 89.125.209[.]168in 1 report
- 103.245.231[.]79in 1 report
- 45.84.59[.]66in 1 report
- etia[.]cain 1 report
- groy[.]ccin 1 report
- gliderrompercycl[.]comin 1 report
- muvb[.]netin 1 report
- divekickspolic[.]orgin 1 report
- matjk[.]clickin 1 report
- bpdaersa[.]clickin 1 report
- stuseamandesilt[.]orgin 1 report
- itechx[.]telin 1 report
- guach[.]netin 1 report
- ruten[.]observerin 1 report
- byveo[.]orgin 1 report
- qumel[.]linkin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.