Threats Tagged 'notifier'

The Larva-24009 threat actor, also known as HeptaX, has been conducting phishing email campaigns since 2023 targeting Korean and global users. The attacks use LNK files disguised as documents on topics like hospital surveys and resumes to deliver malware. Execution triggers obfuscated PowerShell commands that deploy backdoors and download additional scripts. The attack chain includes persistence via Task Scheduler, remote access through QuasarRAT and UltraVNC, and information theft using NirSoft tools, custom keyloggers, and screenshot capabilities. The actor also creates backdoor RDP accounts and exfiltrates credentials, browser data, and user files. Their Notifier malware version 2.1 uses the Telegram API for status reporting. These campaigns show consistent tactics and infrastructure over multiple years.