Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea[html]
We observed several high-volume FormBook malware distribution
campaigns primarily taking aim at Aerospace, Defense Contractor, and
Manufacturing sectors within the U.S. and South Korea during the past
few months. The attackers involved in these email campaigns leveraged
a variety of distribution mechanisms to deliver the information
stealing FormBook malware, including:
- PDFs with download links
- DOC and XLS files with
malicious macros - Archive files (ZIP, RAR, ACE, and ISOs)
containing EXE payloads
The PDF and DOC/XLS campaigns primarily impacted the United States
and the Archive campaigns largely impacted the Unites States and South Korea.
FormBook Overview
FormBook is a data stealer and form grabber that has been advertised
in various hacking forums since early 2016. Figure 1 and Figure 2 show
the online advertisement for the malware.
Figure 1: FormBook advertisement
Figure 2: FormBook underground pricing
The malware injects itself into various processes and installs
function hooks to log keystrokes, steal clipboard contents, and
extract data from HTTP sessions. The malware can also execute commands
from a command and control (C2) server. The commands include
instructing the malware to download and execute files, start
processes, shutdown and reboot the system, and steal cookies and local passwords.
One of the malware's most interesting features is that it reads
Windows’
