According to the data collected by Netskope Threat Labs, over the course of 2023, OneDrive was the most exploited cloud app in terms of malware downloads. And if a good day starts in the morning, 2024 does not promise anything good.
In fact, at the beginning of January, and after a nine-month break, researchers from Proofpoint detected a new financially motivated campaign by TA866, a threat actor characterized for being involved in activities related to both cybercrime and cyberespionage.
In their latest campaign, the threat actors flooded targets in North America with several thousands of emails containing PDF documents with subject lines that should entice victims to open the files. PDF files rank steadily on the top of the list of popular malware file types, and this campaign is no exception. The PDFs contained OneDrive URLs that, if clicked, triggered a multi-step infection leading to the installation of the Screenshotter malware payload, a screenshot grabber utility weaponized by the attackers, via a well-known dropper.
In particular, the OneDrive link served a JavaScript file that, if run by the user, would download and run an MSI file, executing the malicious dropper WasabiSeed. The WasabiSeed VBS script would then download and execute a second MSI file containing components of the Screenshotter screenshot utility which would take a screenshot of the desktop and send it to the C2.
This is yet another example where the attackers