<p class="MsoNormal" style="text-align: justify; "><span style="font-size:22.0pt;line-height:107%"><span style="font-size: 18pt;"><b>Hackers are
exploiting a hugely popular deep space image</b></span></span></p><p class="MsoNormal" style="text-align: justify; "><span style="font-size:22.0pt;line-height:107%"><span style="font-size: 18pt;"><b><br></b>Cyber-security has identified this
unique attack.</span></span></p><h6 style="text-align: justify;" class=""><img src="/media/django-summernote/2022-09-29/06e5ff31-2825-490e-b9cf-8edbb2e5a233.png" style="width: 698.013px;"></h6><h2 class="entry-sub-title" style="text-align: justify; padding: 0px; margin: -5px 0px 15px; list-style: none; border: 0px; outline: none; line-height: 27px; font-size: 22px; color: rgb(84, 84, 84); font-family: -apple-system, BlinkMacSystemFont, &quot;Segoe UI&quot;, Roboto, Oxygen, Oxygen-Sans, Ubuntu, Cantarell, &quot;Helvetica Neue&quot;, &quot;Open Sans&quot;, Arial, sans-serif;"><b>A newly-discovered hacking campaign is exploiting an image from the James Webb Telescope to infect targets with malware.</b></h2><p class="MsoNormal"><span style="font-size:22.0pt;line-height:107%"><span style="font-size: 18pt;"> </span><o:p></o:p></span></p><p class="MsoNormal" style="text-align: justify;"><span style="font-size:22.0pt;line-height:107%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style="font-size: 18pt;">A newly discovered hacking campaign is
exploiting an image that is from the James Webb Telescope to infect some targets
by using malware.</span><o:p></o:p></span></p><p class="MsoNormal" style="text-align: justify;"><span style="font-size:22.0pt;line-height:107%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style="font-size: 18pt;">James Webb produced the deepest and
sharpest infrared image in the month of July which was of the most distant
universe to date, known as the “First Deep Field”. </span><o:p></o:p></span></p><p class="MsoNormal" style="text-align: justify;"><span style="font-size:22.0pt;line-height:107%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style="font-size: 18pt;">Now, the Securonix Threat research team
has identified a persistent Golang-based attack campaign, that incorporates an
equally to interesting strategy by leveraging the deep field image taken from
the James Webb and obfuscated Golang (or go) programming language payloads to
infect the target system with the malware.</span><o:p></o:p></span></p><p class="MsoNormal" style="text-align: justify;"><span style="font-size:22.0pt;line-height:107%">&nbsp;</span></p><p class="MsoNormal" style="text-align: justify;"><span style="font-size:22.0pt;line-height:107%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style="font-size: 18pt;">Golang-based malware is based on the rise
gaining popularity with Apt hacking groups such as Mustang Panda. And Go is an
open-source programming language developed in 2007 by Robert Griesemer, Rob
Pike, and&nbsp; Ken Thompson at Google.</span><o:p></o:p></span></p><p class="MsoNormal" style="text-align: justify;"><span style="font-size:22.0pt;line-height:107%">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style="font-size: 18pt;">Initially, the infection begins with a
phishing email containing a Microsoft Office attachment. The document includes an
external reference hidden inside the document’s metadata which downloads a
malicious template file, conclusion by research.</span><o:p></o:p></span></p><p style="text-align: justify; margin: 0cm 0cm 18.75pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span style="font-size: 18pt; font-family: Helvetica; color: rgb(44, 47, 52);">When the document is opened, the malicious template
file is downloaded and saved on the system.&nbsp;</span><span style="color: rgb(44, 47, 52); font-family: Helvetica; font-size: 18pt;">Finally, the script downloads a JPEG image that
shows the James Webb Telescope deep field image.</span></p><p style="text-align: justify; margin: 0cm 0cm 18.75pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span style="font-size:22.0pt;font-family:&quot;Calibri&quot;,sans-serif;
mso-ascii-theme-font:minor-latin;mso-hansi-theme-font:minor-latin;mso-bidi-theme-font:
minor-latin;color:#2C2F34">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style="font-size: 18pt; font-family: Helvetica;">This
image file is quite interesting. It executes as a standard jpg image as seen in
the image below. However, these things get interesting when inspected with a
text editor, This is all explained by researchers.</span><o:p></o:p></span></p><p style="text-align: justify; margin: 0cm 15pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span style="font-family: Calibri, sans-serif;"><span style="font-size: 18pt; font-family: Helvetica;">The
generated file is a&nbsp;</span><span style="font-size: 18pt; outline: none 0px; -webkit-font-smoothing: antialiased; transition: all 300ms ease 0s; list-style-position: outside; border: 1pt none windowtext; padding: 0cm; font-family: Helvetica; background-color: transparent;"><font color="#000000">Windows</font></span><span style="font-size: 18pt; font-family: Helvetica;">&nbsp;64-bit
executable which is a large size, at around 1.7 MB.</span><span style="font-size: 29.3333px; font-family: Helvetica;">&nbsp;</span></span><span style="font-family: Helvetica; font-size: 18pt;">Securonix
recommended that users avoid downloading unknown email attachments from
non-trusted sources and prevent&nbsp;</span><span style="font-family: Helvetica; font-size: 18pt; background-color: rgb(255, 255, 255); outline: none 0px; -webkit-font-smoothing: antialiased; transition: all 300ms ease 0s; list-style-position: outside; color: rgb(38, 187, 219); border: 1pt none windowtext; padding: 0cm;">Microsoft Office&nbsp;</span><span style="font-family: Helvetica; font-size: 18pt;">products
from using the company's security recommendations.</span></p><p style="text-align: justify; margin: 0cm 0cm 18.75pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;"><span style="font-size:22.0pt;font-family:&quot;Calibri&quot;,sans-serif;
mso-ascii-theme-font:minor-latin;mso-hansi-theme-font:minor-latin;mso-bidi-theme-font:
minor-latin;color:#2C2F34">&nbsp;</span></p><p>

























</p><p class="MsoNormal" style="text-align: justify;"><span style="font-size:22.0pt;line-height:107%;mso-bidi-font-family:
Calibri;mso-bidi-theme-font:minor-latin">&nbsp;</span></p>