What We Do
How We Do
Resources
Company
Partners
Get Started
Security advisories

Spear Phishing – SEC Campaign

February 26, 2019 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

The Threat

The eSentire Security Operations Center has observed a spear phishing campaign targeting customers in the financial industry. The email claims to originate from the Securities and Exchange Commission and arrives bundled with a malicious Microsoft Word Document. The document uses the Dynamic Data Exchange (DDE) protocol to execute malicious PowerShell code which downloads and executes DNSMessenger malware. If successful, this attack allows the threat actor to interact with the victim’s system.

What you should do about it

Additional Information

Email Indicators

Subject: EDGAR Filings

From: [email protected] (spoofed)

Filings and Forms rules

Dear TARGETNAME,

The SEC's Office is issuing this EDGAR Alert to inform EDGAR members about changes in EDGAR Filings.

Attachment:
Filings_and_Forms.docx

When opened, it presents the user with the following message:

[image src="/assets/32bc1ece0c/Spear-Phishing-SEC-Campaign.png" id="1227" width="495" height="132" class="center ss-htmleditorfield-file image" title="Spear Phishing SEC Campaign" alt="Spear Phishing SEC Campaign"]

Clicking Yes on the pop up will initiate the download of DNSMessenger malware.


Clicking Yes on the pop up will initiate the download of DNSMessenger malware.

For additional information, please visit:

http://blog.talosintelligence.com/2017/10/dnsmessenger-sec-campaign.html

View Most Recent Advisories