{"id":82966,"date":"2016-05-30T15:03:13","date_gmt":"2016-05-30T09:33:13","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=82966"},"modified":"2016-06-06T15:09:18","modified_gmt":"2016-06-06T09:39:18","slug":"infostealer-campaign-detected-in-the-wild","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/infostealer-campaign-detected-in-the-wild\/","title":{"rendered":"Infostealer Campaign detected in the wild"},"content":{"rendered":"

Quick Heal Threat Research Lab has recently observed an active cybercrime campaign designed to steal user info. The campaign has been noticed to make use of three keyloggers (malicious software that records information entered by a user on their computer keyboard) iSpy logger, Predator logger and Knight Logger. These software are easily available on the Internet and can be used for keylogging, stealing passwords and capturing screenshots.<\/p>\n

In May 2016, Quick Heal detected an attack related to this campaign, on the computers of multiple users. The attack uses spear phishing emails with attachments of malicious Microsoft Office documents (RTF). These documents are loaded with codes that exploit the CVE-RTF-2012-0158 vulnerability. When the receiver opens any of these RTF documents, a keylogger component is dropped on the computer, which then does rest of the job.<\/p>\n

Infection Vector
\n<\/strong>The user receives an email about the arrival of a shipment. The email carries a malicious attachment containing the code to exploit the CVE-RTF-2012-0158 vulnerability. Once the document is opened, one of the software (iSpy, Predator, Knight Logger) is dropped on the victim\u2019s computer.<\/p>\n

Below is what the email looks like.<\/p>\n

\"DHL_email\"<\/a><\/p>\n

Download this PDF to read the full report<\/strong><\/p>\n

\"PDF<\/a><\/p>\n

 <\/p>\n

Security measures to take<\/strong><\/p>\n