Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Skeleton Spider, also known as FIN6, is a financially motivated cybercrime group that has evolved from POS breaches to broader enterprise threats. They employ social engineering tactics, posing as job seekers on platforms like LinkedIn to deliver phishing messages. Their preferred payload is more_eggs, a JavaScript-based backdoor. The group uses trusted cloud services like AWS to host malicious infrastructure, evading detection. Their phishing emails impersonate job applicants, with domains mimicking real names. FIN6 employs sophisticated filtering techniques to ensure malware delivery only to intended targets. The more_eggs malware, developed by Venom Spider, allows for command execution and credential theft. Defense strategies include cautious handling of resume links, blocking execution of suspicious files, and implementing EDR policies.

Skeleton Spider, also known as FIN6, is a financially motivated cybercrime group that has transitioned from primarily targeting point-of-sale (POS) systems to launching broader enterprise-level attacks. Their current modus operandi involves sophisticated social engineering campaigns, notably posing as job seekers on professional networking platforms like LinkedIn. They send phishing emails impersonating job applicants, using domains that closely mimic legitimate names to increase credibility. The payload of choice is the more_eggs malware, a JavaScript-based backdoor developed by the Venom Spider group. This malware enables attackers to execute arbitrary commands and steal credentials from compromised systems. A notable aspect of this threat is the use of trusted cloud infrastructure, specifically Amazon Web Services (AWS), to host malicious components. This tactic helps evade traditional detection mechanisms that might block known malicious IPs or domains. FIN6 also employs advanced filtering techniques to ensure that their malware is delivered only to intended targets, reducing noise and increasing the likelihood of successful compromise. The attack chain involves phishing with resume lures containing links or attachments that, when interacted with, lead to the execution of the more_eggs backdoor. The malware leverages various techniques such as process injection, persistence mechanisms, and command and control communications over legitimate protocols to maintain stealth and persistence within victim environments. The group’s use of cloud services and evasion tactics complicates detection and response efforts. Defensive measures recommended include heightened scrutiny of unsolicited resume links, blocking execution of suspicious JavaScript files, and deploying Endpoint Detection and Response (EDR) solutions with policies tuned to detect behaviors associated with more_eggs and related tactics.

Detailed information about Eggs in a Cloudy Basket: Skeleton Spider's Trusted Cloud Malware Delivery. Get real-time updates, technical details, and mitigation s

Title	Severity	Type	Source	Date

Threats Tagged 'cloud infrastructure'

Filter Threats

Threats Tagged 'cloud infrastructure'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility