More Signs of the more_eggs Backdoor Found in the DNS

Using resumes as a social engineering lure isn’t new. But they’re more often than not employed in run-of-the-mill phishing campaigns.

This time around, threat actor TA4557 utilized a weaponized resume to drop a backdoor called “more_eggs,” which leads to a persistent attack that results in credential theft.

The WhoisXML API research team obtained a published list of 17 more_eggs indicators of compromise (IoCs) and expanded it to identify more connected artifacts.¹ Our in-depth analysis found:

• 35 email-connected domains
• 11 additional IP addresses, three of which turned out to be malicious
• 700 IP-connected domains, 131 of which turned out to be malicious
• 22 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/