Threat video1:00
XWorm Curriculum-vitae Phishing Wave: Detection & IOCs
Fake job-application emails deliver XWorm in the Curriculum-vitae-catalina wave; 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for XWorm Curriculum-vitae Phishing Wave: Detection & IOCs →
Chapters
- 0:00The hookWorm surge about 1.60% through fake CVs.
- 0:05The storyIn October, phishing delivered XWorm to ICS systems.
- 0:12Attack pathPhishing sends fake CVs with malware.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise8 indicators to hunt: 8 file names.
- 0:37MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to command and control.
- 0:42Remediation3 steps now: Block or detonate executable attachments at the email gateway, especially.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Worm surge about 1.60% through fake CVs.
0:05In October, phishing delivered XWorm to ICS systems.
0:09By December it subsided.
0:12Phishing sends fake CVs with malware.
0:14If victims open them, systems become compromised.
0:18Email and removable media are key vectors.
0:21Activity peaked in October, subsided in December.
0:27No threat actor is attributed. Confidence: low.
0:328 indicators to hunt: 8 file names.
0:3810 ATT&CK techniques, from initial access to command and control.
0:433 steps now: Block or detonate executable attachments at the email gateway, especially.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.