He then thinks nothing more of the event.
The attacker then proceeds to exfiltrate a package containing all of the interesting documents from the newly infected system.
This malware gathers data from compromised machines through what is known as a smash-and-grab attack.
This attack is being carried out against high-level targets and makes use of NSFW content.
The second campaign has been nicknamed Operation Advtravel.
It is a low-level targeted attack affecting only a few hundreds in Egypt.
It mainly infects personal laptops.
Traces of its attackers have been found in Egypt.
The similarities in the attacks is that they both are being hosted from a server based in Germany.
Israel has blocked all digital communication from Gaza to avoid such attacks, but Germany isnt blocked by Israel.
Plus, the server is also registered under the same people who are detailed above.
The main reason is that the attacks are emanating from German servers, which are not blocked by Israel.
Moreover, the use of NSFW content in the emails adds that much more honey to the click bait.
The employee wont even report it if the email contains NSFW content for fear of shame.
source: www.techworm.net
