Hello and welcome to the Monday, March 16th, 20206 edition of the Sands and then at Storm Center's Stormcast.

My name is Johannes Orich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu graduate certificate program in

Purple Team Operations. And today we got a couple of interesting diaries to talk about. The first one is

by Brad about a click fix campaign that is then pushing Remco's rat. Now this is all associated with SmartApe SG, a threat actor that Brad has talked about before.

In the past, they have deployed other rats like, for example, Net Support Manager.

Overall, the attack is, well, what we have seen so many times, where a victim is presented with a fake capture that tricks them into copy-pasting or command into their window system that will then download the malware.

As usual, Brad is sharing also all the evidence, including packet cap, just the like.

So this is a great diary kind of to follow along Brad's analysis and learn also a little bit more about how to analyze these kind of compromises.

And the second diary from this weekend comes from Jan.

And Jan is looking at an interesting fishing trick being played here.

It all starts fairly straightforward. The victim receives a PDF.

The PDF itself is harmless other than it contains a link to a Cloudflare worker.

And that Cloudflare worker is used in order to display the fishing page with a lot of

JavaScript. Now, the one trick here that the attacker is playing, the attacker is collecting,

of course, credentials. And in the example that Jan shows, they're impersonating Dropbox,

but they have to get the credentials somehow to the attacker.

In the past, we have seen stuff used like Telegram, for example, is very popular.

A bunch of different APIs. What they're using in this particular case is email JS.

Email.js allows you to send email with JavaScript. Of course, JavaScript itself doesn't allow you to, like, speak SMTP or such. So instead, they're connecting to the email JS web service that allows you to then send HTTP requests to the web service that will then result in the email being sent to the attacker.

So an interesting twist on this. Of course, I think it makes it a little bit easier than to actually

find the attacker given that you can check what email JS account or so they're using.

...