Gophish Framework Used in Phishing Campaigns to Deploy Remote Access Trojans
A new phishing effort has targeted Russian-speaking users, using the open-source phishing toolkit Gophish to spread DarkCrystal RAT (also known as DCRat) and PowerRAT, an unreported remote access trojan.
According to a Tuesday analysis by Cisco Talos researcher Chetan Raghuprasad, the campaign uses modular infection chains that are either HTML-based or Maldoc-based infections and need the victim's interaction to start the infection chain.
The language used in the phishing emails, the bait content in the malicious documents, links that pose as Yandex Disk ("disk-yandex[.]ru"), and HTML web pages that pose as VK, a social network that is mostly utilized in the nation, are all used to determine that Russian-speaking people are being targeted read more about Gophish Framework Used in Ph...