From South America to Southeast Asia: The Fragile Web of REF7707
Essential information
- Published
- 12/02/2025 21:39
- Modified
- 12/02/2025 21:53
- Tags
- 2025-02-12 certutil finaldraft guidloader linux lolbas lolbin pathloader persistence powershell ref7707 remote admin scheduled task siestagraph southeast asia typo squatting windows
- Related entities
- 40 observables, 6 techniques (mitre), 3 malware, 3 others
Description
While the REF7707 campaign is characterized by a well-engineered, highly capable, novel intrusion set, the campaign owners exhibited poor campaign management and inconsistent evasion practices.