Threat video1:00
Income Tax Department Fake Notice Malware: Detection & IOCs
Fake Income Tax penalty notices sent on WhatsApp deliver a ZIP lure that fetches a second stage; 28 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for Income Tax Department Fake Notice Malware: Detection & IOCs →
Chapters
- 0:00The hookAbout 31 lookalike domains hit taxpayers.
- 0:04The storyForged penalty notices arrive.
- 0:11Attack pathLookalike domains host the forged notice.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise27 indicators to hunt: 1 IP, 18 domains and 1 URL, and more.
- 0:36MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to command and control.
- 0:42Remediation3 steps now: Block the listed lookalike domains, vss2[.]oss-cn-hongkong[.]aliyuncs[.]com.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 31 lookalike domains hit taxpayers.
0:05Forged penalty notices arrive.
0:07Download Documents delivers malware.
0:11Lookalike domains host the forged notice.
0:14An Android app intercepts SMS messages.
0:17A signed Windows file poses as Service Host.
0:20It fetches a second stage.
0:25No threat actor is attributed. Confidence: low.
0:2927 indicators to hunt: 1 IP, 18 domains and 1 URL, and more.
0:3616 ATT&CK techniques, from resource development to command and control.
0:423 steps now: Block the listed lookalike domains, vss2[.]oss-cn-hongkong[.]aliyuncs[.]com.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.