+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: FBI Warns Software Supply Chain Corporations about ongoing attacks against them (/Thread-FBI-Warns-Software-Supply-Chain-Corporations-about-ongoing-attacks-against-them)
FBI Warns Software Supply Chain Corporations about ongoing attacks against them - SaMoo7 - 03-30-2020
FBI alerts US private sectors about attacks aimed at their supply chain software providers. The FBI has sent a security alert to the US private sector about an ongoing hacking campaign; FBI says hackers are attempting to infect companies with the Kwampirs RAT. The alert did not identify the targeted software providers, nor any other victims.
![[Image: FBI.jpg]](https://i.ibb.co/5KcVCT4/FBI.jpg)
This RAT use "CreateProcessAsUserW" for the creation of second instance of a genuine process, under rundll32 with credentials of current logged in user, for example, you can see in the above pic Genuine Process - "wmiapsrv.exe" and tempered process is "wmipvsre.exe"
RE: FBI Warns Software Supply Chain Corporations about ongoing attacks against them - refa - 03-30-2020
Interesting news. I've heard of this rat.
RE: FBI Warns Software Supply Chain Corporations about ongoing attacks against them - mothered - 03-31-2020
A sophisticated attack that can certainly cause significant damage.
To the untrained eye, the process looks very legit.
RE: FBI Warns Software Supply Chain Corporations about ongoing attacks against them - SaMoo7 - 03-31-2020
(03-31-2020, 05:35 AM)mothered Wrote: A sophisticated attack that can certainly cause significant damage.
To the untrained eye, the process looks very legit.
Exactly