Uptycs Blog

Welcome! The Uptycs blog is for security professionals and osquery enthusiasts interested in exploring new ideas in cloud security. We hope you’ll enjoy our blog enough to subscribe and share.

IcedID campaign spotted being spiced with Excel 4 Macros

IcedID campaign spotted being spiced with Excel 4 Macros

Research by Ashwin Vamshi and Abhijit Mohanta

Quick-Look Summary:

  • IcedID appears to be taking the place of Emotet, based on a significant influx of samples in our threat intelligence systems
  • A majority of these IcedID samples are distributed via xlsm files attached to emails
  • We’ve identified three ways these Excel 4 Macros are evading detection

Recent trends in malicious document techniques, targets, and attacks

Recent trends in malicious document techniques, targets, and attacks

Research by Ashwin Vamshi and Abhijit Mohanta

The Uptycs threat research team is monitoring ongoing targeted attacks and trends. We’ve recently seen threat actors and APT groups frequently using two document-based techniques: template injection and the Equation Editor exploit. In this piece, we’ll cover these oft-used techniques and provide details on the APT groups applying them.

Confucius APT deploys Warzone RAT

Confucius APT deploys Warzone RAT

Research by Abhijit Mohanta and Ashwin Vamshi

Uptycs' threat research team published a piece about Warzone RAT and its advanced capabilities in November 2020. During the first week of January 2021, we discovered an ongoing targeted attack campaign related to Confucius APT, a threat actor / group primarily targeting government sectors in South Asia. This attack was identified by our in-house osquery-based sandbox that triggered a detection on Warzone RAT activity.

Revenge RAT targeting users in South America

Revenge RAT targeting users in South America

The Uptycs threat research team recently came across multiple document samples that download Revenge RAT. The campaign currently seems to be active in Brazil. All of the malware samples we received have the same properties. One of the samples we received has the name “Rooming List Reservas para 3 Familias.docx” (SHA-256: 91611ac2268d9bf7b7cb2e71976c630f6b4bfdbb68774420bf01fd1493ed28c7). The document has only a few detections in VirusTotal.

Warzone RAT comes with UAC bypass technique

Warzone RAT comes with UAC bypass technique

Uptycs' threat research team identified an XLS document that downloaded a highly vicious payload named Warzone RAT. The payload, also known as “Ave Maria stealer,” can steal credentials and log keystrokes on the victim’s machine. Checkpoint mentioned Warzone early this year when the malware was in its early stage of development.