Trusted Design

August in December: New Information Stealer Hits the Scene

概要

During the month of November, Proofpoint observed multiple campaigns from TA530 - an actor we have previously referred to as the "personalized actor" for their highly personalized campaigns[6] - targeting customer service and managerial staff at retailers. These campaigns utilized “fileless” loading of a relatively new malware called August through the use of Word macros and PowerShell. August contains stealing functionality targeting credentials and sensitive documents from the infected computer.

Created: 2026-02-23

Indicators

• URL - http://pg4pszczyna.edu.pl/config/config.asp -
• URL - http://www.overstockage.com/image/image.asp -
• URL - https://paste.ee/r/eY3Ui -
• URL - http://thedragon318.com/exchange/port10/gate/ -
• FileHash-SHA256 - c432cc99b390b5edbab400dcc322f7872d3176c08869c8e587918753c00e5d4e -
• URL - http://muralegdanskzaspa.eu/network/port10/gate/ -
• URL - http://himalayard.de/exchange/port10/gate/ -
• URL - http://muralegdanskzaspa.eu/network/outlook.asp -
• URL - http://krusingtheworld.de/port/login.asp -
• URL - http://krusingtheworld.de/port/jp/gate/ -
• URL - http://www.overstockage.com/catalog/core/gate/ -
• URL - http://pg4pszczyna.edu.pl/config/install/gate/ -
• URL - http://thedragon318.com/exchange/owalogon.asp -

類似Pulses

• MarsJoke Ransomware Mimics CTB-Locker (score: 0.63)
• CryptFile2 Ransomware Returns in High Volume URL Campaigns (score: 0.63)
• A VAST Malvertising Attack (score: 0.62)
• Targeted Crimeware in the Midst of Indiscriminate Activity (score: 0.61)
• NetTraveler APT Targets Russian, European Interests (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る