Hello, welcome to the Friday, December 17, 2021 edition of the Sansonet Stormer's Stormcast. My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Brad today has news about the contact forums campaign. This campaign is particularly tricky in that it does send messages using a company's

contact form. So the message will arrive like any other message submitted via your contact form

that you may have on your website. And it then includes a threat that, well, there is some

kind of copyright infringement going on in your organization with a link where you can download evidence of this infringement.

And as usual, this Malware campaign also likes Google's cloud services, in this case storage..googleapis.com.

Multiple of these documents are hosted on Google APIs.com and it usually takes quite a while

for them to be removed if ever. The file downloaded is an ISO file. If you open it, you

are only seeing by default a document icon that points to what

looks like, at least based on the file name, evidence of whatever activity you're being

accused of. But it's actually a link and there are two hidden files in this directory. One is a

JavaScript file. One is a DLL. And if you're clicking on the link, then these files are being executed.

So a couple of tricks here that are being used to get the user to execute the malware.

First of all, it does not arrive as a normal email, but it arrives via a contact form.

So that usually means it's a little bit more trusted than just a random email.

The legal threat, of course, may help.

And then it uses a well-known, often trusted domain, Google APIs.com.

And the icons don't necessarily give away that you're actually executing software as you're

clicking and trying to open this file with evidence.

P-caps, melrose samples, and more can as usually be found in Brad's diary from today.

And then we've got an interesting new group of attacks against wireless chips now.

Before we get too excited about wireless one and billies, the threat model here is a little bit

...