More Signs of the more_eggs Backdoor Found in the DNS
Using resumes as a social engineering lure isn’t new. But they’re more often than not employed in run-of-the-mill phishing campaigns.
This time around, threat actor TA4557 utilized a weaponized resume to drop a backdoor called “more_eggs,” which leads to a persistent attack that results in credential theft.
The WhoisXML API research team obtained a published list of 17 more_eggs indicators of compromise (IoCs) and expanded it to identify more connected artifacts.1 Our in-depth analysis found:
- 35 email-connected domains
- 11 additional IP addresses, three of which turned out to be malicious
- 700 IP-connected domains, 131 of which turned out to be malicious
- 22 string-connected domains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/