Researchers Expose Phishing Threats Distributing CountLoader and PureRAT
A new campaign has been seen that uses phishing attempts to pose as Ukrainian government entities in order to deploy CountLoader, which is subsequently used to dump PureMiner and Amatera Stealer.
According to Yurren Wan, a researcher at Fortinet FortiGuard Labs, the phishing emails contain malicious Scalable Vector Graphics (SVG) files that are intended to fool recipients into opening dangerous attachments, as reported by The Hacker News.
A Compiled HTML Help (CHM) file is contained in a password-protected ZIP archive that is downloaded using the SVG files in the attack chains that the cybersecurity firm has documented. When the CHM file is started, a series of actions are initiated that lead to the deployment of CountLoader. According to the emails, the National Police of Ukraine h...