Trusted Design

IRS Refund-themed Spam Campaign Delivers Kovter and CoreBOT

概要

IOCs derived from post on https://heimdalsecurity.com/blog/security-alert-fileless-kovter-teams-modular-corebot-malware-irs-spam-campaign/ IRS-refund themed spam campaign claiming to be a refund notification from the IRS. The spam email includes a .zip attachment. In that attachment, there is a .js file which will activate Windows PowerShell in order to download the primary payload as soon as the .zip file is opened. The primary payload appears to be Kovter, and the seconday one CoreBOT. Kovter is a Trojan whose primary use was performing click-fraud operations on the PCs it infected. But, earlier this year, Kovter was seen incorporating new cloaking tricks in order to evade detection. Its core assets: the ability to remain hidden and to persist for a longer period in the memory of the compromised machines. CoreBOT is a type of modular malware, which allows cyber criminals to build upon it and has evolved from data-stealing malware to financial malware almost overnight earlier this year.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• CoreBot from WSH .js kovter / miruef actors (score: 0.67)
• PowerSniff Malware Used in Macro-based Attacks (score: 0.63)
• Ransomware: Kovter Associated (score: 0.63)
• Necurs Botnet Fuels Massive Spam Campaigns Spreading Jaff Ransomware (score: 0.62)
• Affiliate’s Malspam Operation: Kovter and Miuref/Boaxxe (score: 0.62)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る