🚨Threat Campaign Alert - Fake FCI Job Listings Target Indian Job Seekers with XELERA Ransomware via Malicious Documents and Discord Bot🚨 Summary: Researchers have uncovered a phishing campaign targeting Indian job seekers with fake Food Corporation of India (FCI) job to distribute XELERA ransomware. Delivered via malicious Word documents, the Python-based malware, packed with PyInstaller, employs a Discord bot for command and control. This allows threat actors to deploy ransomware, steal credentials, exfiltrate data, manipulate system settings, and corrupt the Master Boot Record (MBR), leading to severe system disruption. Threat Actor/Threat Group: Not Mentioned Malware: XELERA Ransomware, MEMZ Trojan Targeted Countries: India Targeted Industries: Individual, Job Applicants Targeted Applications/CVE: Not Mentioned Impact: Data Breach, Device compromise, Ransomware attacks, System disruption, MBR Corruption IOC: SHA-256 ff06ce3fd6fe994aeaa0edc5162989d08f34440e9cacbc9e49e5db8ef98a74e3, 519401c998fe5d6eb143415f7c17ad5f8e5ef5ebae57ac91e9fa89a0bfcf0c7f, URL's hxxps[:]//github[.]com/Sam-cpu999/stuff/raw/main/MEMZ[.]exe, hxxps[:]//th[.]bing[.]com/th/id/OIP.nQu9CQ9gM84Pblh6AgykIgHaHa?rs=1&pid=ImgDetMain, hxxps[:]//pghnetworks[.]com/wp-content/uploads/2018/06/Blog-pic[.]jpg, hxxps[:]//thugging[.]org/static/kkk[.]png, hxxps[:]//thugging[.]org/static/3[.]mp4, hxxps[:]//chochox[.]com/wp-content/uploads/2016/10/Geto 29[.]jpg, MITRE TTP IDs: T1566.001(Phishing: Spear phishing Attachment), T1204.002(User Execution: Malicious File), T1059.006(Python), T1547.001(Registry Run Keys / Startup Folder), T1562.001(Impair Defenses: Disable or Modify Tools), T1555.003(Credentials from Web Browser), T1033(System Owner/User Discovery), T1217(Browser Information Discovery), T1010(Application Window Discovery), T1083(File and Directory Discovery), T1016(System Network Configuration Discovery), T1560.002(Archive via Library), T1056.001(Keylogging), T1113(Screen Capture), T1102.002(Bidirectional Communication), T1531(Account Access Removal), T1486(Data Encrypted for Impact), T1657(Financial Theft), T1491.001(Internal Defacement), T1561.001(Disk Content Wipe), T1489(Service Stop), T1529(System Shutdown / Reboot) ------------------------------------------------------------------------------------------ 🚀Join us on our mission to secure the digital world and make cyber defense affordable to everyone! 🌐 Follow "CyberXTron Technologies" for the timely, relevant and actionable cyber threat insights. #XELERA #Ransomware #DiscordBot #CyberThreats #JobScam #MITREATTACK #FCIJobs #IndianJobApplicants #PythonMalware #DiscordBot #PhishingCampaign #DataBreach #CyberThreats #FinancialSecurity #India #APT #ThreatHunting #ThreatIntelligence #cyberXTron #uncovertheunknown🛡️🔒