🚨 Formbook is Back with Regional Lures

This threat report details a resurgence of the Formbook malware campaign using regionalized lures aimed at European users and manufacturing sectors. The infection chain starts with a JavaScript lure that triggers hidden PowerShell execution, which then decrypts and loads an AES-protected .NET payload. The payload uses process hollowing on aspnet_compiler.exe to run Formbook under the name rekeywiz.exe. The loader bypasses PowerShell execution policies and uses a watchdog mechanism to retry injection attempts. Persistence is achieved through SystemUpdate_ps_*.lnk shortcuts and related PowerShell scripts. Network detection tools like Suricata have flagged Formbook's command-and-control traffic and suspicious domain requests. The report includes multiple IOCs such as domain names and file hashes to aid detection and response.

The Formbook malware campaign enables attackers to maintain persistence on infected systems, potentially allowing data theft or further compromise. The use of process hollowing and execution policy bypass techniques complicates detection. The campaign targets European users and manufacturing organizations, indicating a focused threat. Suricata detection of C2 traffic suggests network-based detection is possible. No direct exploit or vulnerability is described, but the malware's presence poses a medium risk to affected organizations.

No official patch or remediation is indicated in the source. Defenders should use the provided IOCs to detect and block the malware and its command-and-control infrastructure. Network detection tools like Suricata can identify Formbook C2 check-ins. Monitoring for the described persistence artifacts (SystemUpdate_ps_*.lnk, PowerShell scripts in C:\Temp) and suspicious process activity (powershell.exe spawning aspnet_compiler.exe without arguments) can aid in identification. Standard endpoint detection and response (EDR) solutions should be updated to detect these behaviors. There is no indication that vendor patches or fixes are available or required.