{"id":40908,"date":"2021-05-17T14:25:58","date_gmt":"2021-05-17T14:25:58","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/32293\/RevengeRAT-And-AysncRAT-Target-Aerospace-And-Travel-Sectors.html"},"modified":"2021-05-17T14:25:58","modified_gmt":"2021-05-17T14:25:58","slug":"revengerat-and-aysncrat-target-aerospace-and-travel-sectors","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/revengerat-and-aysncrat-target-aerospace-and-travel-sectors\/","title":{"rendered":"RevengeRAT And AysncRAT Target Aerospace And Travel Sectors"},"content":{"rendered":"
\n
American Airlines flight 718, a Boeing 737 Max, is seen parked at its gate at Miami International Airport as passengers board for a flight to New York on December 29, 2020 in Miami, Florida. A campaign of remote access trojans is targeting the aerospace and travel industries.<\/a> (Photo by Joe Raedle\/Getty Images)<\/figcaption><\/figure>\n

Microsoft Security Intelligence<\/a> earlier this week tweeted out<\/a> that it has been tracking a campaign of remote access trojans (RATs)<\/a> targeting the aerospace and travel industries with spear-phishing emails that distribute an actively developed loader, which then delivers RevengeRAT <\/a>or AysncRAT.<\/a><\/p>\n

As part of the tweet exchange it was pointed out that attackers use the RATs for data theft, follow-on activity and additional payloads, including Agent Tesla,<\/a> which they use for data exfiltration. The loader is under active development and is dubbed Snip3 by Morphisec.<\/a><\/p>\n

These campaigns come as no surprise, especially as we exit lockdown and people are traveling again, making the travel industry a highly-lucrative target, said Chris Morales, chief information security officer at Netenrich.<\/p>\n

\u201cThe level of targeting is also a reason why it\u2019s so hard to detect attacks,\u201d Morales said. \u201cThey change and are tailored. SecOps has to align to with threats targeting their organizations specifically and not look for generic threats.\u201d<\/p>\n

Dirk Schrader, global vice president, security research, at New Net Technologies, said he expects to see sector-oriented spear-phishing campaigns as we come out of the pandemic.<\/p>\n

\u201cUsing familiar language and terminology can help in the effectiveness of a targeted campaign,\u201d Schrader said. \u201cIt\u2019s not shocking that attackers are targeting the transport sector as the sector is about to come back to life. Therefore, a well-crafted campaign addressing this situation is even better.\u201d<\/p>\n

Roger Grimes, data driven defense evangelist at KnowBe4, added that when the attackers break into one industry firm, they can read their emails and use the newly compromised place as a \u201ccyberhaven\u201d to attack their partners.<\/p>\n

\u201cThe emails come from people and email addresses the new victims trust, using email subject threads they have participated in,\u201d Grimes said. \u201cSo, when the request to click on a link or open a document comes unexpectedly, there\u2019s a far higher chance that the new victim will fall for the scam. That\u2019s why all employees need to learn that phishing emails could come from people they know and trust, and simply relying on an email address, whether they recognize it or not, isn\u2019t a enough.\u201d<\/p>\n

Grimes said security awareness training should teach users to beware of emails with the following traits:<\/p>\n