🚨 ALERT: Cybercriminals are sending out fake Telekom invoices via phishing emails to deliver multiple malicious RAT payloads. The activity originates from an attack cluster tracked by Telekom Security under the name "Rodent Weed". 🧵1/6

The malicious shellcodes contain multiple RATs, in this case AsyncRAT/VenomRAT, XenoRAT and XWorm. All RATs refer to the same C2 server IP 178[.]16[.]53[.]106 and DNS name krusty-krab[.]duckdns[.]org 🧵5/6

Fraudsters have now started using EPC QR codes in fake invoices that can be opened by many banking apps. These codes already contain all the necessary transfer information for the app to start a simple transfer action for the victim. (1/3)

We detected three different campaigns from the same threat actor targeting German companies in the name of the Federal Central Tax Office and insurance companies over the last month. (2/3)

🚨 Telekom Security detected a major #vishing campaign against multiple targets in #Germany, likely related to a ransomware group. We are still analyzing, but here is what we know so far 🧵1/x

When this final payload was executed, it connected to a C2 server at myocubookstore[.]com. We do believe that also wth[.]so, mrhardinero[.]com, borderlessandbeyond[.]com, brideofrove[.]com, aempodcast[.]com are part of the same infrastructure and campaign. 🧵8/x