More_eggs

More_eggs, also known as Golden Chickens, is a dangerous malware suite used by financially-motivated cybercrime actors such as the Cobalt Group and FIN6. This malicious software is designed to infiltrate systems through suspicious downloads, emails, or websites, often without the user's knowledge, and can steal personal information, disrupt operations, or hold data hostage for ransom. The malware has been identified in various cyber threats and nation-state attacks, with its use first observed as early as 2017 against targets including Russian financial institutions, mining firms, and other multinational organizations. The distribution of More_eggs is particularly insidious due to its use of social engineering campaigns and spear-phishing techniques. These methods target recruiters with benign content before infecting their machines with the malware. Attackers have also used phishing emails to distribute .zip files disguised as images to initiate a More_eggs infection. In a June campaign, LinkedIn was leveraged to trick recruiters into accessing a fake job resume site that distributed the malware as a malicious .lnk file. Furthermore, the malware has been seen in email campaigns targeting Russian businesses and job seekers with phony job offers. More_eggs is part of the Golden Chickens toolkit, which is distributed by Venom Spider, an underground Malware-as-a-Service (MaaS) provider also known as badbullzvenom. The identity of this provider, a Romanian man known as VENOM SPIDER, was uncovered by eSentire earlier this year. Organizations with managed detection and response (MDR) systems can set up custom filters and models to detect specific threats like More_eggs, automating responses to alerts. However, pinning down the exact identity of other groups using More_eggs, such as TA4557, FIN6, Cobalt Group, and Evilnum, remains challenging due to overlapping activities.