Blog

• 29 December, 2020
• No Comments

GitHub-hosted Malware Calculates Cobalt Strike Payload From Imgur Pic

GitHub-hosted Malware Calculates Cobalt Strike Payload From Imgur Pic A new strand of malware uses Word files with macros to download a PowerShell script from GitHub. This PowerShell script further downloads a legitimate image file from image hosting service Imgur to decode a Cobalt Strike script on Windows systems. Multiple researchers have potentially linked this strain to MuddyWater (aka SeedWorm and TEMP.Zagros), a government-backed advanced persistent