STRRAT - RAT Embedded in PDF attachment

[juice]

Just sharing this...

RAT embedded in pdf attachment as posing as 'Fake' Ransomware, even though it does re-write files it doesn't encrypt them

https://threatpost.com/email-campaign-fake-ransomw...

Email examples here

https://twitter.com/MsftSecIntel/status/1395138351...




Will probably come from one of these domains, so would suggest blacklisting on your SPAM Catcher

EmailUrlInfo
| where UrlDomain has_any ('metroscaffingltg.co.uk',
'pg-finacesolutions.co.uk',
'jpfletcherconsultancy.co.uk',
'buildersworlinc.co.uk',
'bentlyconstbuild.co.uk',
'alfredoscafeltd.co.uk',
'zincocorporation.co.uk',
'playerscircleinc.co.uk',
'tg-cranedinc.co.uk',
'adamridley.co.uk',
'westcoasttrustedtaxis.co.uk',
'sivospremiumclub.co.uk',
'gossyexperience.co.uk',
'jeffersonsandc.co.uk',
'fillinaresortsltd.co.uk',
'tk-consultancyltd.co.uk')

Cheers