September 4, 2018 By Douglas Bonderud 2 min read

Researchers discovered a new downloader, dubbed AdvisorsBot, as part of an attack campaign that uses malicious emails to target companies in the telecommunications and hospitality industries.

First observed by Proofpoint in May 2018, AdvisorsBot is a previously undocumented downloader that’s now appearing as part of a phishing campaign crafted specifically to compromise telecommunications companies, restaurants and hotels. According to Proofpoint, the campaign is likely the work of a threat actor known as TA555, who uses this malware as a first-stage payload.

While AdvisorsBot is modular and contains command-and-control (C&C) capabilities, Proofpoint has only observed the malware actively sending fingerprint module data — which it uses to identify potential targets — back to the C&C. Over the past four months, three separate AdvisorsBot variations have been used in attack campaigns; the latest iteration included an entirely PowerShell version of the malware.

Malicious Emails Highly Targeted to Specific Industries

Key to the success of this malware campaign is the use of malicious emails designed to elicit a response from targets. Restaurants receive messages about food poisoning with attached doctors’ reports, for example, while hotels are targeted with emails about double service charges with attached credit statements. Telecommunications companies, meanwhile, receive job application emails with resumes or CV attachments.

If users open these malicious attachments and enable Microsoft Word macros, AdvisorsBot downloads, fingerprints the system for potential interest to attackers and then sends this data to the C&C server. The result is an increased risk of phishing success with emails that go the extra mile to appear legitimate.

Another concern around AdvisorsBot is ongoing development. As noted by Proofpoint, the malware is “under active development and we have also further observed another version of the malware completely rewritten in PowerShell and .NET.” In May and June, for example, the malicious documents contained PowerShell scripts to download AdvisorsBot. On Aug. 8, the macro was modified to include a PowerShell command that downloaded another PowerShell script before downloading the malware.

In addition, AdvisorsBot uses junk code and Windows application programming interface (API) function hashing to evade security analysis. This continual evolution means that successfully countering one version of AdvisorsBot may not ensure defense against the next.

How to Avoid AdvisorsBot

According to the IBM X-Force Exchange advisory for this threat, security teams should block specific IPs (162.244.32.148 and 185.180.198.56) associated with AdvisorsBot, along with URLs such as investments-advisors.bid, interactive-investments.bid and real-estate-advisors.win.

IBM experts also recommend adopting a layered approach to email security that includes spam control and monitoring, external mail scanning, perimeter protection, and training for end users to avoid common phishing attack techniques — such as the highly targeted malicious emails that precede AdvisorsBot infections.

Source: Proofpoint

More from

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Cybersecurity Awareness Month: 5 new AI skills cyber pros need

4 min read - The rapid integration of artificial intelligence (AI) across industries, including cybersecurity, has sparked a sense of urgency among professionals. As organizations increasingly adopt AI tools to bolster security defenses, cyber professionals now face a pivotal question: What new skills do I need to stay relevant?October is Cybersecurity Awareness Month, which makes it the perfect time to address this pressing issue. With AI transforming threat detection, prevention and response, what better moment to explore the essential skills professionals might require?Whether you're…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today