Fairly convincing phishing campaign that I think would fool a large percentage of HR people. The phisher responds to a help wanted ad and attaches an ISO file.
Viewing the ISO in Windows Explorer shows it contains a cover letter, resume and other materials for HR to process the application.
In fact, the ISO has a signed
executable file, a nonmalicious decoy document , and a malicious
DLL file. The .exe file mimics an MS Word file. The file contains “.doc” file name extension and contains the MS Word icon
as a means of confusing the victim and thinking that the file is safe to open.
Double clicking on this .doc file loads the malicious DLL. This is a technique, known as DLL sideloading, installs the threat actors’ core malware, TelePowerBot and ensures it has persistence. Before the infection is finished, the decoy document loads.
I mean, how do businesses defend against that?
@dangoodin Not to be a wiseacre, but uh, don't use Windows?
Long ago Microsoft added tons of cool features to make things more convenient and automatic for users without considering the consequences for security.
@shuttersparks @dangoodin My first thought was who uses Windows Explorer??? But yes, I wasn’t saying that to be snarky. I was just laughing. Thank you for the important information.