World Watch OCD

@ocdworldwatch.bsky.social

48 Followers 90 Following

World Watch CTI team from Orange Cyberdefense https://www.orangecyberdefense.com/global/offering/managed-services/threat-and-risk-management/world-watch

Scheme showing overlaps between payloads and infrastructure elements.

This is a scheme describing the infection chain.
1. Email received.
2. Download a ZIP file from an actor-controlled website.
3. User clicks on an executable that sideloads a malicious DLL.
4. The malicious DLL unpacks an archive contained in the ZIP file, opens a Word document, and executes a Python script or a BAT file to fetch the final payload.