Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1072512" data-attributes="member: 32260">WHHLight vs. Spica attack(Smart App Control set to OFF)[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/google-russian-fsb-hackers-deploy-new-spica-backdoor-malware.128457/#post-1072430[/URL][URL unfurl=&quot;false&quot;]https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/[/URL]Attack Flow:PDF lure document (encrypted) ----&gt; emails ----&gt; link to the cloud storage&nbsp; ---&gt;&nbsp; malware downloaded/executed by the user (EXE file)The malware uses PowerShell to obtain persistence. It is unclear from the article if the malware uses a PS1 script. If so, then the script will be blocked by default SWH settings.Anyway, the main protection can be applied by SmartScreen or WHHLight WDAC settings. In both cases, this particular malware is blocked (confirmed myself). The Spica sample from the article can be found via Google. The sample never gained a sufficient reputation, so SmartScreen + WDAC ISG could easily block it also as 0-day.The user could be infected only when ignoring/bypassing the SmartScreen or WDAC alert. Such a scenario is probable when the user is a child or a happy clicker. It can be prevented by setting &lt;SmartScreen Block&gt; = ON, in WHHLight. But, this will require more attention &amp; help from the &quot;home administrator&quot;.</blockquote>

[QUOTE="Andy Ful, post: 1072512, member: 32260"] [B][SIZE=5]WHHLight vs. Spica attack[/SIZE] (Smart App Control set to OFF)[/B] [URL unfurl="false"]https://malwaretips.com/threads/google-russian-fsb-hackers-deploy-new-spica-backdoor-malware.128457/#post-1072430[/URL] [URL unfurl="false"]https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/[/URL] [COLOR=rgb(184, 49, 47)][B]Attack Flow:[/B][/COLOR] [B]PDF lure document (encrypted) ----> emails ----> link to the cloud storage ---> malware downloaded/executed by the user (EXE file)[/B] The malware uses PowerShell to obtain persistence. It is unclear from the article if the malware uses a PS1 script. If so, then the script will be blocked by default SWH settings. Anyway, the main protection can be applied by SmartScreen or WHHLight WDAC settings. In both cases, this particular malware is blocked (confirmed myself). The Spica sample from the article can be found via Google. The sample never gained a sufficient reputation, so SmartScreen + WDAC ISG could easily block it also as 0-day. The user could be infected only when ignoring/bypassing the SmartScreen or WDAC alert. Such a scenario is probable when the user is a child or a happy clicker. It can be prevented by setting <SmartScreen Block> = ON, in WHHLight. But, this will require more attention & help from the "home administrator". [/QUOTE]

Verification