Malware – OSTap uses RDP based ActiveX to infect with TrickBot
Uncategorized February 29th, 2020Some of the RDP exposures recently patched by Microsoft in recent months during “Patch Tuesday” — are important as a technical defense against new innovated malware attacks
A group of hackers is using the remote desktop ActiveX control in Word documents to automatically execute on Windows 10 a malware downloader called Ostap that was seen recently adopted by TrickBot for delivery. Ostap, extensively analyzed by Bromium researchers, is delivered via a Word document laced with malicious macro code and including an image that allegedly showed encrypted content. This is the ruse to trick victims into enabling macros in the document.
