New Covid-Related Phishing Campaign Spreads Agent Tesla RAT
Even though an increasingly larger part of the world's population is getting vaccinated for Covid-19 and the global hysteria that had gripped the world in the first half of 2020 is now gradually dying down and life is slowly returning to a semblance of normalcy, there is still enough anxiety to allow bad actors and hackers to pull off schemes related to the virus.
In the latest instance of Covid-themed malware campaigns, security researchers have noticed a new phishing campaign is afoot, spreading the Agent Tesla remote access Trojan (RAT). The new push to spread Agent Tesla was spotted by Romanian security researchers and uses a fake Covid vaccination plan as the lure.
The body of the malicious emails is written in a succinct, business-like manner and encourages potential victims to take action and review some sort of made-up "issue" with their vaccination registration. The email bait mentions unspecified "technical issues" and invites victims to click a link. One of the very first signs that there is something wrong with the email is that it has several grammatical and syntactic mistakes in its text, despite its relatively short length.
The Agent Tesla RAT itself is nothing new, it has been tracked by security researchers for the better part of a decade now. Even though the RAT was primarily used as to steal passwords in the past, its newest versions have an expanded set of malicious capabilities, including better detection avoidance and even better data scraping tools.
The malicious attachment carried in the phishing email is a rich text format .rtf file that abuses a pretty old vulnerability that was hugely popular with bad actors a few years ago. The vulnerability in question was codified as CVE-2017-11882 and has been long-since patched, as the 2017 year identifier in the designator suggests. However, it seems whoever is running this latest campaign is on the lookout for users who are still running outdated versions of Microsoft Office 2007 to 2016.
Any information the RAT manages to scrape from the infected system, it transfers to its operators through SMTP.
As with any phishing campaign, the best way to stay safe is to never click links or open attachments contained in unsolicited emails. Sometimes more elaborate phishing lures composed by native speakers have perfect grammar and can even use the logos of the legitimate institution they are trying to mimic. Being extra careful and keeping an anti-malware suite installed and updated at all times can help further reduce the threat of opening a malicious email and getting infected with malware.
