By 
Security researchers have uncovered a campaign in which French entities and organizations have been targeted with the info-stealing banking malware TinyNuke.
Proofpoint researchers stated that the attackers used invoice-themed lures targeting entities in manufacturing, construction, technology, finance, and business services.
The TinyNuke malware which was first spotted in 2017, had its activity at its peak in 2018 and was significantly dropped in 2019. Now it has emerged and the threat actors are using it to steal credentials and other private information and deliver additional payloads.
The researchers found that TinyNuke reappeared in January 2021 in one campaign distributing around 2,000 emails. Subsequent campaigns appeared in low volumes in May, June, and September. In November, multiple TinyNuke campaigns distributing around 2,500 messages and impacting hundreds of customers were found.
The malicious messages used in the invoice-themed lures contain download links pointing to a ZIP compressed executable responsible for installing TinyNuke.
At least two distinct activity sets using TinyNuke based on different lure themes, C2 infrastructure, and payload deployment were discovered. According to the experts, one of these two clusters was associated with the initial TinyNuke operators, while the second one was associated with a threat actor that uses commodity tools.
The attackers used legitimate, but compromised websites, to host the payload URL. Most of the websites involved in the campaigns use the French language.
Once installed, the TinyNuke loader can be used to steal sensitive data and credentials with form-grabbing and webinject capabilities for popular browsers (Firefox, Internet Explorer, and Chrome), and to install additional payloads.
