Based on telemetry and investigation conducted by WithSecure, one approach employed by the threat actor is to scout for companies that operate on Facebook’s Business/Ads platform and directly target individuals within the company/business that might have high-level access to the Facebook Business. We have observed individuals with managerial, digital marketing, digital media, and human resources roles in companies to have been targeted. WithSecure Countercept Detection and Response team has identified instances where the malware was delivered to victims through LinkedIn.
These tactics would increase the adversary’s chances of compromising the respective FacebookBusiness all the while flying under the radar. Some of the observed samples have been hosted on file or cloud hosting services, such as Dropbox, iCloud, and MediaFire. The malware was often delivered as an archive file which contained the malware executable alongside related images, documents, and video files. The content and file names (listed in the appendices section) revealed how the threat actor intended to lure victims into launching their malware. The file names generally utilized keywords related to brands, products, and project planning. Some examples include: “project development plan, project information, products.pdf.exe” and “new project l'oréal budget business plan.exe”. Moreover, some of the observed samples had country names appended to the file name which indicates that the threat actor tailors the file name based on the target’s locality. This indicates that the threat actor was aware of the victim’s locations ahead of time. WithSecure’s telemetry suggests that the threat actor does not target a specific region or country.
