{
  "name": "Malvertising Campaign Leads to Execution of Oyster Backdoor",
  "slug": "malvertising-campaign-leads-to-execution-of-oyster-backdoor",
  "description": "Rapid7 has observed a recent malvertising campaign that lures users into downloading malicious installers for popular software such as Google Chrome and Microsoft Teams.",
  "published": "2024-06-24T16:48:29+00:00",
  "created_at": "2024-06-24T16:48:29+00:00",
  "modified_at": "2024-06-24T16:53:55+00:00",
  "created_at_opencti": "2024-06-24T16:48:29+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-06-24",
    "execution",
    "http post",
    "json",
    "lnk file",
    "malicious",
    "malware",
    "microsoft teams",
    "oyster main",
    "persistence",
    "powershell",
    "python script",
    "schtasks",
    "temp directory"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "206.166.251.114"
      },
      {
        "id": "",
        "name": "149.248.79.62"
      },
      {
        "id": "",
        "name": "64.95.10.243"
      },
      {
        "id": "",
        "name": "whereverhomebe.com"
      },
      {
        "id": "",
        "name": "prodfindfeatures.com"
      },
      {
        "id": "",
        "name": "micrsoft-teams-download.com"
      },
      {
        "id": "",
        "name": "impresoralaser.pro"
      },
      {
        "id": "",
        "name": "supfoundrysettlers.us"
      },
      {
        "id": "",
        "name": "retdirectyourman.eu"
      },
      {
        "id": "",
        "name": "cfc2fe7236da1609b0db1b2981ca318bfd5fbbb65c945b5f26df26d9f948cbb4"
      },
      {
        "id": "",
        "name": "9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43"
      },
      {
        "id": "",
        "name": "82b246d8e6ffba1abaffbd386470c45cef8383ad19394c7c0622c9e62128cb94"
      },
      {
        "id": "",
        "name": "574c70e84ecdad901385a1ebf38f2ee74c446034e97c33949b52f3a2fddcd822"
      }
    ],
    "malware": [
      {
        "id": "d448c000-39d9-4588-b602-7479fa641594",
        "name": "Oyster Main",
        "slug": "oyster-main"
      }
    ],
    "attack_patterns": [
      {
        "id": "1e043fe4-2413-4b8e-887c-0fe45d095a24",
        "name": "T1583"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "6aa7866f-9c1f-4159-938a-10a6adf41646",
        "name": "T1553"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://www.rapid7.com/blog/post/2024/06/17/malvertising-campaign-leads-to-execution-of-oyster-backdoor/",
    "https://otx.alienvault.com/pulse/6679bf7ef90d73c4ccc58180"
  ]
}