THE CURIOUS CASE OF AN EGG-CELLENT RESUME

Summary from the TLDR InfoSec newsletter

An in-depth look at a sophisticated campaign conducted by TA4557/FIN6 that utilized a resume lure to compromise a system. The fake resume zip contained a malicious .lnk file which was used to start an execution flow with several LOLBins payloads to establish a foothold. The threat actor then established persistence by deploying C2 software and creating a new user before performing recon to discover a target for lateral movement. The threat actor then compromised and pivoted to a Veeam backup server which they used to compromise another server. The attacker then utilized Cloudflared and Cobalt Strike for persistence but didn't perform any more actions before being evicted.