Stone Wolf employs Meduza Stealer to hack Russian companies
Essential information
- Published
- 02/09/2024 20:50
- Modified
- 02/09/2024 21:31
- Tags
- 2024-09-02 data theft industrial automation meduza stealer phishing russian companies
- Related entities
- 41 observables, 1 intrusion sets (apt), 22 techniques (mitre), 2 malware, 2 others
Description
A malicious campaign by a group called Stone Wolf has been targeting Russian companies using phishing emails impersonating a legitimate industrial automation provider. The attackers aim to deliver Meduza Stealer, a commercial malware available on underground forums. The campaign involves sending an archive containing a legitimate document as a decoy and a malicious link that downloads and executes Meduza Stealer. The malware collects various data from compromised systems, including credentials, system information, and application data. The attackers use obfuscation techniques and multiple stages to evade detection. The campaign highlights the ongoing threat of commercial malware and the importance of employee cybersecurity training.